CVE-2026-53712

The record

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519; getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException, and the ScramClient builder treats that as absent channel-binding data. This issue is fixed in version 3.3.

Affected packages

Related vulnerabilities

• CVE-2026-95860 node-opcua is an OPC UA implementation for TypeScript and Node.js. CWE-636
• CVE-2026-109593 An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier… CWE-636
• CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-636
• CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP… CWE-636
• CVE-2026-105933 Apache Pulsar allows an administrator to require end-to-end message encryption for all… CWE-636
• CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. CWE-636
• CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed… CWE-636
• CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthorized… CWE-636