CVE-2019-19519: OpenBSD

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.

Affected products

• OpenBSD OpenBSD: version 6.6 only

Published 2019-12-05. Last modified 2026-06-17.