OpenSSH versions prior to 10.3 do not verify the confirmation step when establishing multiplexed proxy-mode sessions. This omission allows an attacker who can initiate a multiplexed connection to the SSH server to create proxy tunnels without the SSH server confirming proper session parameters. The result is a potential degradation of data integrity: traffic routed through these tunnels may be manipulated or replaced. The core weakness is related to missing authentication of multiplexed sessions, classified under CWE-306 (Missing Authentication for Critical Function) and CWE-420 (Untrusted Control of Resource).

Affected systems are OpenBSD OpenSSH installations running any build before version 10.3p1. No further sub‑version information is supplied, so any release older than 10.3p1 can be impacted.

The CVSS score of 2.5 signals a low severity issue. Exploitation requires an attacker who can reach the SSH port and issue a multiplexed connection request. The EPSS score is below 1%, indicating a very small likelihood of real‑world exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack path does not provide remote code execution or denial of service; it mainly affords integrity degradation through unverified proxy tunnels.