CVE-2016-7145: NEFARIOUS2 Project NEFARIOUS2

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.

Affected products

Published 2017-03-07. Last modified 2026-06-17.