The flaw resides in phpseclib’s SSH2::get_binary_packet() method, where the incoming packet’s HMAC is compared to a locally computed value using PHP’s != operator. For equal‑length binary strings, != invokes memcmp(), which stops at the first differing byte, resulting in a variable‑time comparison (CWE‑208). This timing side‑channel can leak the correct HMAC byte by byte, allowing an attacker to forge SSH packets that the library will accept.

Any PHP application that imports the Net SSH2 class from phpseclib and remains on a release before 3.0.51, 2.0.53, or 1.0.28 is vulnerable. This includes both client and server implementations that rely on this library for SSH communication.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score of <1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation would require an attacker able to send crafted SSH packets and measure precise timing differences, potentially enabling packet forging and privilege escalation on systems that accept SSH connections from untrusted sources.