The bug allows source-address restrictions set in authentication callbacks to be ignored for all methods except PublicKeyCallback. An attacker connecting from an untrusted IP can create a legitimate authentication callback that returns a Permissions structure with a source-address critical option. Because the check is not enforced for PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin, the restriction is silently bypassed, enabling the attacker to log in or gain privileges he should not have. The impact is a loss of confidentiality and integrity for the SSH service and any resources the authenticated user can access.

Vendors: golang.org/x/crypto for the golang.org/x/crypto/ssh package. All releases of golang.org/x/crypto/ssh that contain the unpatched callback enforcement logic are vulnerable. The exact affected versions are not listed, so any version prior to the fix that includes the code should be considered at risk and updated to a new release.

The vulnerability can be exploited remotely via the SSH protocol, as an attacker can connect to the service and supply a malicious authentication callback. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The lack of enforcement of source-address restrictions effectively reduces the SSH server’s ability to restrict access based on IP, making it easier for a remote attacker to bypass configured firewall rules or IP-based controls. Given that the bug allows bypass of a critical security feature, it is considered a high-risk exploitation scenario.