CVE-2025-58060

Date: September 11, 2025

Authentication bypass in cups prior to 2.4.13 - Any configuration that allows an |AuthType| that is not |Basic| is affected. Versions lower than 2.4.3 are affected in less serious way - if attacker provides valid credentials for Basic authentication and cupsd requires Kerberos authentication on resource (and vice versa), the attack is still possible because cupsd ignores its own authentication settings if the creds are valid. In those cases, the prerequisite for the attack is the attacker would obtain allowed user credentials/Kerberos ticket, which is more difficult.