The vulnerability is a critical authentication bypass that allows an attacker to impersonate any user, including the administrator, by offering the victim’s public key during the SSH handshake before authenticating with their own valid key. This flaw arises because the user identity is stored in the session context during the offer phase and is not cleared if that particular authentication attempt fails. As a result, an unauthenticated attacker can exploit the session to perform actions as the targeted user, potentially compromising all privileged operations and data within the server.

Charmbracelet Soft Serve versions 0.11.2 and earlier are affected. The product is the self‑hostable Git server for the command line, running on any system where Soft Serve 0.11.2 or older is installed. The fix was released in version 0.11.3 and applies to all supported platforms, including containers and binary packages.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests exploitation is currently unlikely under typical circumstances. The vulnerability is not listed in the CISA KEV catalog, further implying limited reported use. Attackers would need network access to the Soft Serve instance’s SSH port and the ability to initiate an SSH connection. Once they provide the victim’s public key, the server will associate the session with that identity despite the failed authentication attempt, enabling unauthorized operations until the session is terminated.