Authentication Bypass by Primary Weakness Affecting openssh package, versions [0,]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-OPENSSH-22249323
- published5 Nov 2026
- disclosed5 Nov 2026
- creditÖzgün Kültekin
Introduced: 5 Nov 2026
NewCVE-2026-123158 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via sys_auth_passwd() accepting a crypt() failure value as a valid password hash. An attacker could log in as any account whose /etc/shadow password field is * (such as root or a key-only user) by submitting a 257–1024 character password.
Notes
Successful exploitation depends on all of the following:
- sshd is built without PAM (UsePAM no or not compiled in) and linked against musl libc.
- Password authentication is enabled (PasswordAuthentication yes, the default).
- The target account has exactly * as its shadow password. A ! does not work.
- At least one other account has a real password hash.
- The attacker knows the target username.