OpenSSH versions prior to 10.3 incorrectly parse the principals option in authorized_keys when it appears alongside a certificate authority that includes comma characters in its principal list. This parsing error lets an attacker create a key entry that satisfies a different principal than intended, thereby bypassing the configured authorization restrictions and potentially granting unauthorized access to higher privileges.

The issue impacts OpenBSD OpenSSH deployments running any release before 10.3. Systems that rely on principal restrictions for user identity or certificate-based access may be vulnerable if their authorized_keys entries reference a certificate authority with comma-separated principal entries.

The CVSS score of 4.2 signifies moderate severity, and the EPSS score of less than 1 % indicates a low likelihood of automated exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The probable attack vector is inferred: an attacker capable of modifying the authorized_keys file or who can obtain a certificate signed by a CA containing commas in its principal list could exploit the flaw. No public exploit has been documented yet, though the potential for privilege escalation remains for affected deployments.