The vulnerability arises when an SSH server in golang.org/x/crypto/ssh receives an authentication callback other than VerifiedPublicKeyCallback. In this scenario, the source-address validation that normally limits which clients may connect is bypassed, allowing any client to authenticate without meeting the intended network restrictions. This represents an authorization bypass that undermines the integrity of access control for the SSH service.

The flaw affects the golang.org/x/crypto SSH package. Specific version details are not disclosed in the current data, but any deployment of this library that uses custom authentication callbacks is potentially vulnerable.

The CVSS score of 10 indicates a critical impact, and the EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed exploit evidence. However, the risk is significant for systems that rely on source-address filtering for security; an attacker capable of supplying a non-public key callback could bypass address restrictions, achieving unauthorized access. The likely attack vector is through a misconfigured SSH server that accepts custom callbacks from clients, which an adversary could supply in a crafted connection attempt.