# CVE-2026-13122 - Server assert via malformed auth-token with external-auth
-
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled.
+
OpenVPN 2.6 and 2.7 allow remote attackers to cause a denial of service via a malformed authentication token when the server is configured with `auth-gen-token` using the `external-auth` keyword. When the token length is invalid, the server triggers a reachable assertion.
+
+
Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.
