From dd6a984afb77505edc4fc9ef475f070649dbe6ae Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Jul 2026 08:22:17 +0200 Subject: [PATCH] xauth-generic: Make sure to only use secrets that match the username This ensures that secrets that are associated with the server identity, usually they are assigned to the username exclusively, will only be tried if the username also matched. Otherwise, it could be possible for users who know at least one password to impersonate another user. Fixes: 462c9a4f72ec ("Try all matching XAuth secrets we find, not only the first one") --- src/libcharon/plugins/xauth_generic/xauth_generic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/libcharon/plugins/xauth_generic/xauth_generic.c b/src/libcharon/plugins/xauth_generic/xauth_generic.c index 93c676f35..54df03bee 100644 --- a/src/libcharon/plugins/xauth_generic/xauth_generic.c +++ b/src/libcharon/plugins/xauth_generic/xauth_generic.c @@ -134,6 +134,7 @@ METHOD(xauth_method_t, process_server, status_t, configuration_attribute_t *attr; enumerator_t *enumerator; shared_key_t *shared; + id_match_t match_other; identification_t *id; chunk_t user = chunk_empty, pass = chunk_empty; status_t status = FAILED; @@ -179,9 +180,10 @@ METHOD(xauth_method_t, process_server, status_t, enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr, SHARED_EAP, this->server, this->peer); - while (enumerator->enumerate(enumerator, &shared, NULL, NULL)) + while (enumerator->enumerate(enumerator, &shared, NULL, &match_other)) { - if (chunk_equals_const(shared->get_key(shared), pass)) + if (match_other > ID_MATCH_NONE && + chunk_equals_const(shared->get_key(shared), pass)) { status = SUCCESS; break;