AsyncSSH is a Python package that implements an asynchronous client and server for SSHv2 on top of Python asyncio. Prior to version 2.23.0, the library expands the OpenSSH‑compatible AuthorizedKeysFile %u token in several source files—asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py—with the raw SSH username during a pre‑authentication server configuration reload. When the server’s AuthorizedKeysFile is configured as authorized_keys/%u, an attacker can supply a username containing path‑traversal characters such as /, \\ or .., causing the server to read an authorized‑keys file located outside the intended directory. By selecting the key file that is read, the attacker can authenticate as any username, effectively bypassing the normal authentication flow. This vulnerability is documented as CWE‑22 and was fixed in version 2.23.0.

The vulnerability affects all installations of the AsyncSSH Python package from versions prior to 2.23.0 when the server’s AuthorizedKeysFile is set to a pattern like authorized_keys/%u. The affected vendor is ronf (AsyncSSH) and the flaw is present across all code paths that expand the %u token during server configuration reloads.

The CVSS score of 8.2 reflects a high‑severity authentication bypass. An EPSS score of <1% indicates that active exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, an attacker who can supply a crafted SSH username during an initial connection could exploit the path traversal to load a malicious authorized‑keys file, leading to full control over the target machine. The vulnerability is remotely exploitable and does not require local privileges on the affected system.