CVE-2026-13122 - Server assert via malformed auth-token with external-auth

OpenVPN 2.6 and 2.7 allow remote attackers to cause a denial of service via a malformed authentication token when the server is configured with auth-gen-token using the external-auth keyword. When the token length is invalid, the server triggers a reachable assertion.

Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.