OpenSSH releases prior to 10.3 omit the confirmation step for connection multiplexing sessions that occur in proxy mode. The missing confirmation can allow an attacker to gain knowledge about a session’s establishment process, potentially revealing information about the connection that should have been protected. This weakness aligns with the category of secret information exposure, and it does not directly compromise authentication or disrupt service availability.

The issue affects OpenBSD OpenSSH installations running any version older than 10.3. Users should check the exact release being used, as no additional sub‑release restrictions are specified, and consider that any pre‑10.3 build might be vulnerable.

The CVSS score of 2.5 indicates low severity, and neither EPSS nor CISA KEV data point to widespread exploitation. The likely attack vector involves an attacker who can initiate or observe proxy‑mode multiplexing sessions; the precise conditions for successful exploitation are not detailed in the advisory, so the risk remains modest but the vulnerability should be remediated to avoid inadvertent disclosure.