An active attacker who can intercept SSH traffic can replace the host key blob with one that embeds an ECDSA curve different from the one that the client negotiated. The host key is parsed and used to derive the curve without checking that the identifier matches the negotiated curve, so the client accepts the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification succeeds, resulting in an authentication bypass that allows the attacker to impersonate the server and read or modify all traffic.

WolfSSL Inc.’s wolfSSH SSH server is impacted. All releases prior to the availability of the validation patch are vulnerable, as the vendor has not published specific version ranges for the fix.

The CVSS score of 9.0 indicates very high severity. EPSS is not reported, but the exploit requires an active man‑in‑the‑middle position and the use of permissive key‑verification callbacks such as TOFU or username‑only checks. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be typical SSH clients that accept host keys based solely on the algorithm name or on a fingerprint match. If exploited, the attacker gains full control of the SSH session after the forged key is accepted.