{"cve":"CVE-2022-48195","nvd":{"published":"2022-12-31T01:15:14.417","modified":"2026-06-17T05:14:45.617","status":"Modified","description":"An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["https://mellium.im/cve/cve-2022-48195/","https://mellium.im/cve/cve-2022-48195/"],"products":["mellium:sasl"],"source":"nvd","synced_at":"2026-10-19T21:37:31.370122805+00:00"},"epss":{"cve":"CVE-2022-48195","score":0.009,"percentile":0.59665,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gvfj-fxx3-j323","url":"https://osv.dev/vulnerability/GHSA-gvfj-fxx3-j323","summary":"mellium.im/sasl authentication failure due to insufficient nonce randomness","modified":"2024-05-20T21:43:00Z","packages":[{"ecosystem":"Go","name":"mellium.im/sasl","purl":"pkg:golang/mellium.im/sasl","ranges":["<0.3.1"],"fixed":["0.3.1"]}]},{"id":"GO-2023-1268","url":"https://osv.dev/vulnerability/GO-2023-1268","summary":"Authentication failure in mellium.im/sasl","modified":"2024-05-20T16:03:47Z","packages":[{"ecosystem":"Go","name":"mellium.im/sasl","purl":"pkg:golang/mellium.im/sasl","ranges":["<0.3.1"],"fixed":["0.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}