CVE-2026-53712
Description
A flaw was found in the SCRAM (Salted Challenge Response Authentication Mechanism) client and common libraries. An attacker performing a man-in-the-middle (MITM) attack on a Transport Layer Security (TLS) connection can silently downgrade the authentication process. This vulnerability allows the attacker to bypass the stronger SCRAM-SHA-256-PLUS authentication with channel binding, forcing a weaker SCRAM-SHA-256 authentication without channel binding, which could compromise the integrity of the authentication.
Statement
This Moderate flaw in SCRAM client and common libraries, used in Red Hat products, allows a TLS man-in-the-middle attacker to silently downgrade authentication. While requiring a sophisticated network attack, successful exploitation bypasses stronger channel-bound authentication, potentially compromising the integrity of user sessions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
