The russh SSH server accepted a public‑key authentication signature whose algorithm name did not match the algorithm specified in the authentication request. A client with an RSA private key could advertise rsa-sha2-512 while providing a valid ssh-rsa SHA‑1 signature, allowing the authentication to succeed even though the server was asked to enforce a different algorithm. This mismatch can bypass policy checks that rely on the requested algorithm and can create misleading audit entries, facilitating privilege escalation or stealthy access if the application trusts the algorithm field.

The flaw exists in russh versions from 0.34.0-beta.1 through 0.64.0. Any deployment of the russh library whose SSH server component is built from those releases is affected. The vendor is Eugeny and the issue does not affect Rust SSH clients from the same library. The fix is to upgrade to version 0.64.0 or later.

The CVSS base score is 2.3, indicating low severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to control a client that communicates with the vulnerable server and craft an authentication request using a mismatched algorithm. Because a valid private‑key signature is still required, the attack does not provide arbitrary code execution, but could facilitate policy bypass if the server or downstream applications rely on the algorithm name for access control or logging.