NTLMv2 authentication bypass - Type3#password? ignores its password argument and verifies every message against the empty password
Published: September 09, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-cx24-f932-rr55
- Vendor Advisory: https://github.com/WinRb/rubyntlm/security/advisories/GHSA-cx24-f932-rr55
GEM
UNAFFECTED VERSIONS
< 0.5.0
PATCHED VERSIONS
>= 0.6.6
DESCRIPTION
Type3#password? ignores its password argument on the NTLMv2 path and verifies the message against a blank password instead.
An application using password? to check NTLMv2 credentials will accept any client that sends an empty password for a username it knows, and will reject that account's real password. Knowing a valid username is enough to authenticate as that user.
Impact
Authentication bypass (CWE-303). An application verifying NTLMv2 credentials with Type3#password? can be authenticated to by anyone who knows a valid username. The application doesn't have to misuse the API — password? is public, documented, and the only server-side check the gem offers.