vsftpd: Authentication bypass in ssl_data_accept (CVE-2026-119568)
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections.
CVE search metadata
CVE search record: CVE-2026-119568. Severity: high. CVSS: 7.4. KEV: no. Product: vsftpd (through 3.0.5). Brief: vsftpd: Authentication bypass in ssl_data_accept (CVE-2026-119568). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vsftpd-auth-bypass/
Triage facts
Revision 2- Applicability
- vsftpd (through 3.0.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 30, 13:42 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.