27-Year-Old OpenBSD Authentication Bypass: Details and PoC Exploit Publicly Disclosed

OpenBSD CVE-2026-55706 is a 27-year-old PAP authentication bypass in the sppp_pap_input() handler that lets an attacker on the same Layer 2 network (e.g., a rogue PPPoE server in the broadcast domain) authenticate without credentials by abusing length fields, and can additionally trigger a heap over-read; researchers published full technical details and a working PoC, and OpenBSD issued a patch (commit 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8) — administrators using PAP over PPPoE should update promptly and treat Layer 2 segments as untrusted.