The vulnerability exists in sshd of OpenSSH versions prior to 10.6p2 running on Linux systems that use musl libc without PAM. A flaw in the handling of threshold for password hashes allows an input string between 256 and 1024 characters to be accepted as a valid password for some account configurations, effectively bypassing authentication. The failure results in an attacker gaining unrestricted access to the account without possessing the correct password, compromising confidentiality, integrity, and availability of the host.

OpenBSD's OpenSSH implementation is affected. Any deployment of OpenSSH before version 10.6p2 on Linux with musl libc and no PAM, such as Alpine Linux, is vulnerable. This includes systems maintaining older OpenSSH packages and not applying the 10.6p2 update.

The CVSS base score is 8.1, indicating high severity, and the vulnerability is not listed in the CISA KEV catalog. While EPSS data is not available, the existence of an authentication bypass that works across a wide password length range suggests a substantial attack surface. An attacker with the ability to reach the SSH service can trivially supply a long password string to authenticate as a valid user. No special local privileges are needed, making the vulnerability remotely exploitable.