CVE-2022-22576

What it actually does

The vulnerability allows reuse of OAuth2-authenticated connections for SASL-enabled protocols (SMTP, IMAP, POP3, LDAP) without verifying that the original authentication credentials match those required for the current transfer, enabling credential bypass on connection reuse.

Why it matters to the business

Organizations relying on curl for secure email or directory operations face risk of unauthorized access to sensitive mailboxes or LDAP data, potentially leading to data exposure or compliance violations on legacy or unpatched systems.

How an attack unfolds

An attacker configures a client or application using vulnerable curl to establish an OAuth2-authenticated connection over an affected SASL protocol, then triggers connection reuse for a subsequent transfer with different credentials; the missing credential check permits the attacker to perform actions under the prior authentication context without re-authenticating.

How to fix it

Upgrade curl to a build containing commit 1669b17d3a1a1fd824308544ca0ec02a2a4f50ea or later; disable connection reuse for SASL OAuth2 flows where upgrade is not immediately feasible.

How to confirm the fix worked

Confirm the installed curl version is newer than 7.82.0 or contains commit 1669b17d3a1a1fd824308544ca0ec02a2a4f50ea; test OAuth2 SASL transfers with deliberately mismatched credentials to verify reuse is rejected.

Typical attack path

1. Identify an application or script using curl 7.33.0-7.82.0 with SASL protocols and OAuth2
2. Establish an initial OAuth2-authenticated connection via SMTP/IMAP/POP3/LDAP
3. Force connection reuse for a new transfer specifying different credentials
4. Perform authenticated actions (send/retrieve mail or directory queries) under the reused session without matching credentials

How to detect it

Review application logs and network traces for curl-based SASL OAuth2 sessions showing connection reuse across credential changes; inspect source or build metadata for curl versions 7.33.0 through 7.82.0.

What your security team should do

• Prioritize upgrade of all curl installations to the fixed commit or a release after 7.82.0
• Audit code and configurations using curl with SMTP, IMAP, POP3, or LDAP over SASL OAuth2
• Implement network segmentation and least-privilege OAuth2 scopes for affected protocols until patched
• Monitor for new curl releases and include the library in dependency scanning pipelines