OpenSSH versions prior to 10.3 mishandle the authorized_keys principals option when a principals list is combined with a Certificate Authority that includes comma characters. The server mistakenly accepts the key, treating the comma as a separator and allowing authentication with principals that should be disallowed. This flaw enables an attacker who supplies a credential that meets the misparsed principal criteria to obtain SSH access to the system.

The vulnerability affects OpenBSD OpenSSH installations running any release before version 10.3. All earlier releases—from the initial OpenSSH launch through 10.2—are impacted.

The CVSS score of 4.2 reflects a moderate severity. Exploitation requires the attacker to possess a valid SSH key with a principals list containing comma characters and to trust a Certificate Authority that uses commas in its configuration. The attack vector is inferred from the description, not explicitly documented elsewhere. EPSS data is unavailable, and the flaw is not listed in CISA’s KEV catalog, suggesting limited breadth of public exploitation. Nonetheless, once exploited, the attacker gains unauthorized SSH access to the host.