CVE-2019-13456

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is similar to the "Dragonblood" attack and CVE-2019-9494.

• CWE-203

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1737663Exploit, Issue Tracking, Patch, Third Party Advisory
• https://freeradius.org/security/Vendor Advisory
• https://github.com/FreeRADIUS/freeradius-server/commit/3ea2a5a026e73d81cd9a3e9bbd4300c433004bfaPatch, Third Party Advisory
• https://wpa3.mathyvanhoef.comExploit, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1737663Exploit, Issue Tracking, Patch, Third Party Advisory
• https://freeradius.org/security/Vendor Advisory
• https://github.com/FreeRADIUS/freeradius-server/commit/3ea2a5a026e73d81cd9a3e9bbd4300c433004bfaPatch, Third Party Advisory
• https://wpa3.mathyvanhoef.comExploit, Third Party Advisory

Published

Dec 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13450In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.…
• CVE-2019-13451In Xymon through 4.3.28, a buffer overflow vulnerability exi…
• CVE-2019-13452In Xymon through 4.3.28, a buffer overflow vulnerability exi…
• CVE-2019-13453Zipios before 0.1.7 does not properly handle certain malform…
• CVE-2019-13454ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero …6.5
• CVE-2019-13455In Xymon through 4.3.28, a stack-based buffer overflow vulne…
• CVE-2019-13457An issue was discovered in Open Ticket Request System (OTRS)…4.3
• CVE-2019-13458An issue was discovered in Open Ticket Request System (OTRS)…6.5
• CVE-2019-1346A denial of service vulnerability exists when Windows improp…6.5
• CVE-2019-13461In PrestaShop before 1.7.6.0 RC2, the id_address_delivery an…
• CVE-2019-13462Lansweeper before 7.1.117.4 allows unauthenticated SQL injec…
• CVE-2019-13463An XSS vulnerability in qcopd-shortcode-generator.php in the…6.1