Improper authentication in OpenSSH - #VU159693
Published: November 6, 2026
Vulnerability identifier: #VU159693
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass password authentication and gain unauthorized access.
The vulnerability exists due to improper authentication in system functionality exposed through OpenSSH sshd when handling password authentication requests. A remote attacker can exploit the authentication flaw through sshd to gain access without successfully completing password authentication.
The issue affects some Linux systems where sshd is built and run with PAM support disabled.
Affected software
OpenSSH
Remediation
Install security update from vendor's website.
OpenSSH - update to 10.6p2