CVE-2016-7144

High

Published: 18/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The m_authenticate function in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user via a crafted AUTHENTICATE parameter.

Risk Assessment

Attackers can gain access to other users' accounts, potentially leading to data breaches and privacy violations.

Recommendation

It is recommended to update UnrealIRCd to the latest version to mitigate this vulnerability and to monitor logs for unauthorized login attempts.

Other vulnerabilities in UnrealIRCd

CVE-2026-90668High
In UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7, the webserver does not limit the number of HTTP request headers. A remote attacker can send a request with an unlimited number of headers, causing memory consumption and an unresponsive server, if a websocket or JSON-RPC listener is enabled (disabled by default).

Original NVD description (English source)

The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.