AsyncSSH 2.23.0 contains an incomplete fix that allows a username substitution bypass in the AuthorizedKeysFile configuration. The bug lets a leading tilde (~) or an environment variable ("${ENV}") expand when resolving the authorized-keys file path, permitting path traversal outside the intended directory. This flaw results in unauthorized file access (Path Traversal, CWE-22) and bypass of expected authentication controls (CWE-639).

Ron's AsyncSSH library is affected. All installations of version 2.23.0 are impacted. This issue was fixed in 2.23.1 and later releases, so users of newer versions are not vulnerable. No other vendors are mentioned in the CNA data.

We see a CVSS score of 5.9, indicating medium severity. The EPSS score is listed as <1%, implying a very low probability of exploitation observed to date. The vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is an external SSH client that supplies a crafted username containing a leading ~ or environment variable, or a local process that sets relevant environment variables before launching the server. An attacker can then supply a key file path that resolves to a file outside the authorized-keys directory, potentially accessing or modifying privileged files with the privileges of the SSH session.