CVE-2026-56101
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6
- CVSS vector
- CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-697
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- OpenBSD OpenBSD
Weakness type
Related vulnerabilities
- CVE-2026-73309 — XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
- CVE-2026-80227 — SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
- CVE-2026-18664 — Wrong interpretation of ACL ranges
- CVE-2026-73258 — Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
- CVE-2026-75110 — MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
- CVE-2026-50029 — js-toml has silent type confusion via falsy-primitive duplicate-key bypass
- CVE-2026-20765 — Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User...
- CVE-2026-67207 — Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController