CVE‑2026‑129483: Critical authentication bypass in Cyrus SASL 2.1.28

A critical authentication bypass vulnerability (CVE‑2026‑129483) has been identified in Cyrus SASL 2.1.28. The flaw allows unauthenticated network clients to send a public value that forces a zero shared secret, effectively authenticating as any existing user without a password. The NVD lists a CVSS score of 9.1 and notes that no vendor advisory has been issued and the vulnerability is not yet in the CISA KEV list. The affected version is 2.1.28; a patch is not yet available, so the safest action is to upgrade to a newer release. This bypass could allow an attacker to impersonate any user, read session keys, and potentially access sensitive data. Organizations using Cyrus SASL should monitor for unusual authentication patterns and plan to apply the forthcoming patch. Until then, consider disabling SRP authentication or applying a temporary workaround by rejecting multiples of N in the server code. For full details, see the NVD record: CVE‑2026‑129483 NVD record.