CVE-2025-58060: high-severity vulnerability in OpenPrinting cups
cups has Authentication bypass with AuthType Negotiate
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
CUPS printing system fails to properly validate passwords when using non-Basic authentication methods if a Basic auth header is included in requests. An attacker can bypass authentication and gain unauthorized access to the printer.
When AuthType is configured to anything other than Basic (e.g., Negotiate, Digest), CUPS incorrectly accepts requests containing Authorization: Basic headers without validating the password credential, allowing authentication bypass. This affects all non-Basic AuthType configurations and requires network access to the CUPS service.
In the same product, most dangerous first.