The authentication protocol in the Bluetooth® Mesh Profile Specification versions 1.0 and 1.0.1 is vulnerable if the AuthValue can be identified during the provisioning procedure, even if the AuthValue is selected randomly. If an attacker can identify the AuthValue used before the provisioning procedure times out, it is possible to complete the provisioning operation and obtain a NetKey.
Created bluez tracking bugs for this issue: Affects: fedora-all [bug 1969622]
*** Bug 1963416 has been marked as a duplicate of this bug. ***