Observable Timing Discrepancy vulnerability in Erlang/OTP ssh, affecting the ssh_auth and ssh_options modules, arises when the SSH daemon is configured with the user_passwords or password option. In that case, ssh_auth:check_password/3 performs a PBKDF2‑SHA256 computation with 600,000 iterations (~300 ms) for valid usernames but returns immediately (~0 ms) for invalid usernames via the ssh_options:get_password_option/2 path. This measurable timing difference can be detected in a single authentication attempt, allowing an unauthenticated attacker to distinguish valid from invalid usernames over the network. The weakness, classified as CWE‑208 (Timing Guessing or Tampering), is intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability. This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl. It affects OTP from OTP 29.0 before OTP 29.0.2 and the corresponding SSH from 6.0 before 6.0.1.

Erlang:OTP versions 29.0 through 29.0.1 and the corresponding SSH 6.0 implementation prior to version 6.0.1.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of 0.00354 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can perform the enumeration from any remote host that can reach the SSH port, using only a single authentication attempt to infer a username based on timing. No elevated privileges or code execution are required, but the information gained can accelerate subsequent attacks.