What this actually is.
Technical background, root cause, and affected surface.
An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.2
- Status
- Published
- CWE
- CWE-287: Improper Authentication
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/auth.c: admin_user configuration check bypasses normal credential verification when admin_auth_user matches the connecting account
Root cause: By design the admin auth user bypasses password authentication; the vulnerability is that this bypass is insufficiently restricted and audited
When does this fire?
All conditions must be true for the exploit to succeed.
An AFP account configured as admin auth user authenticates to the server specifying a different target username
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Full authentication bypass; admin can access any user's AFP volumes, files, and data without knowing their credentials
C:H · I:H · A:H
CWE-287: Improper Authentication
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds additional controls and audit logging to the admin auth user mechanism. Remove admin_auth_user configuration entries if not required.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.