OpenSSH versions before 10.3 misinterpret the presence of any ECDSA algorithm in the PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms configuration as a wildcard for all ECDSA algorithms. This causes the SSH daemon to accept any ECDSA key, including those using insecure or improperly validated curves. The weakness, identified as CWE-670, exposes authentication to potential bypass and compromises the integrity and confidentiality of SSH sessions.

The vulnerability applies to all releases of OpenBSD OpenSSH prior to version 10.3. Any system—whether running on Unix, Linux, or other POSIX‑like platforms—that relies on these earlier OpenSSH builds is affected.

The CVSS score of 3.1 indicates a low severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog, suggesting limited active exploitation. Exploitation would likely require the attacker to influence or modify the server configuration or to supply a key that matches an allowed ECDSA algorithm. While the likelihood of successful exploitation is low, the impact of accepting unintended keys warrants prompt patching to prevent potential authentication compromise.