The vulnerability occurs when the russh server library fails to reset user authentication state between successive SSH authentication requests when the principal changes. This allows residual authentication state—such as remaining methods or partial‑success flags—to carry over to a subsequent request for a different user or service, potentially enabling an attacker to bypass authentication checks or gain unauthorized access. The weakness arises from improper state separation during authentication and is classified as an authentication bypass (CWE‑287).

Affected systems are those that host an SSH server implemented with the russh Rust SSH library, specifically versions from 0.34.0-beta.1 up to, but not including, 0.61.0. Custom servers or services embedding this library are impacted; the defect is absent in russh 0.61.0 and later.

The CVSS score of 5.3 indicates moderate severity, while EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting no public exploitation yet. The attack vector is remote network access via the SSH protocol; an attacker would need to perform a sequence of authentication attempts with changing principals to exploit the retained state. Although code execution is not granted, unauthorized logins could lead to privilege escalation if used in concert with other vulnerabilities.