# OAUTH2 bearer not-checked for connection re-use

libcurl reused OAUTH2-authenticated SASL connections without verifying the bearer matched, letting a second transfer with an invalid bearer inherit the authenticated session.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: monnerat
- Disclosed: 2022-04-29
- CVE: CVE-2022-22576
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1552110
- Library page: https://bugbountylibrary.com/r/h1%3A1552110
- Tags: area:oss domain:oss impact:internal-access kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** libcurl connection cache / SASL OAUTH2 auth (SMTP, IMAP, POP3, LDAP)
**Root cause:** The connection cache reuse logic did not compare the OAUTH2 bearer credential of the new transfer against the one used to authenticate the pooled connection, so any bearer (even invalid) matched a live authenticated connection.
**Steps:**
1. Authenticate a connection with `--oauth2-bearer validbearer` to an OAUTH2-capable IMAP server.
2. In the same curl invocation, issue a second transfer via `--next` with `--oauth2-bearer anything` (invalid).
3. Observe libcurl reuses the pooled connection authenticated with validbearer instead of re-authenticating, granting access with the bogus bearer.
**How found:** Researcher (also the patcher) reasoned about the connection cache reuse path for SASL protocols and noticed the bearer credential was not part of the reuse match criteria, then demonstrated with a two-transfer curl command.
**Exploitation:** An attacker or buggy application performing a second transfer with an arbitrary/invalid OAUTH2 bearer against the same host reuses the previously authenticated connection, gaining unauthorized access to the mailbox/resource without valid credentials.
**Insight:** When auditing connection-pool reuse, check whether every credential component (not just username/host) participates in the reuse match; SASL/OAUTH2 mechanisms often store the bearer separately from the password field, leaving it out of the comparison.