Introduction
Attackers can bypass authentication in CUPS administrative interfaces if the system uses any AuthType other than Basic. The flaw can give an attacker access to print server management, where they may be able to read sensitive print jobs or change the configuration. CUPS (Common UNIX Printing System) is the standard printing system for Linux and other Unix-like operating systems. OpenPrinting maintains it, and it runs on millions of systems worldwide.
Technical information
CVE-2025-58060 is an authentication bypass vulnerability in CUPS versions 2.4.12 and earlier. It is triggered when the CUPS configuration sets the AuthType directive to any value except Basic (such as Digest or certificate-based authentication). If a client request includes an Authorization: Basic ... header, CUPS does not check the password, and the request proceeds without proper authentication.
The root cause is a logic flaw in the authentication handling code. When the configured AuthType does not match the type of Authorization header received, the code does not verify the credentials. An attacker can therefore craft an HTTP request with an Authorization: Basic header and have it accepted with an invalid or missing password, as long as the server is not set to use Basic authentication.
The environments hit hardest are the ones that deliberately chose a stronger authentication mechanism, because the flaw makes that configuration ineffective. The vulnerability affects both the CUPS web administration interface (commonly on port 631) and any service endpoints protected by CUPS authentication.
Affected systems and versions
- Product: OpenPrinting CUPS
- Affected versions: 2.4.12 and all earlier versions
- Vulnerable configurations: Any CUPS deployment where
AuthTypeis set to a value other thanBasic(for example,Digestor certificate-based authentication) - Fixed in: CUPS version 2.4.13
Vendor security history
OpenPrinting has addressed several CUPS vulnerabilities in recent years, including remote code execution and privilege escalation issues disclosed in 2024. The project typically responds quickly to security reports and coordinates patch releases with Linux distributions. Because CUPS is so widely deployed, its vulnerabilities can have broad impact, and the industry watches OpenPrinting's security advisories closely.
