OpenSSH’s sshd before version 10.6 stores authentication credentials even when a GSSAPI authentication attempt fails. The improper persistence of these credentials can be used by an attacker to capture the cached data and reuse it, thereby bypassing normal authentication checks. Based on the description, it is inferred that this could allow an attacker to gain unauthorized access when a failed GSSAPI authentication attempt leaves credentials available for reuse, potentially undermining authentication integrity.

The affected vendor is OpenBSD, product OpenSSH. All OpenSSH releases older than 10.6 are affected. Users running versions earlier than 10.6 on OpenBSD systems should verify their current release and update accordingly.

The CVSS score of 2.2 classifies this as a low‑severity issue. The EPSS score of < 1% indicates that the likelihood of this vulnerability being exploited in the wild is very small, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, via an SSH session that attempts GSSAPI authentication; exploitation requires a failed authentication followed by credential persistence, which limits the attack window. Overall, the threat remains low although updating mitigates any possibility of credential misuse.