The flaw in libssh results in the gssapi-keyex path not verifying whether the authenticated Kerberos principal is authorized for the requested local user. This omission allows an attacker who has established Kerberos authentication to log in as any local user, effectively bypassing the intended access controls. The weakness is an example of improper authorization (CWE‑863) and can enable unauthorized access on affected systems.

The vulnerability affects Red Hat Enterprise Linux releases 8, 9 and 10, as well as Red Hat Hardened Images that ship with the libssh implementation. The specific fix or update is not detailed, so all consuming installations of libssh on these platforms are potentially vulnerable.

The CVSS score of 8.8 classifies this as high severity, but the EPSS score of less than 1% indicates that the probability of exploitation in the wild is currently low. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly–known exploitation has been observed. Exploitation requires the server to have the GSSAPIKeyExchange feature enabled and the attacker must be able to authenticate via Kerberos, after which they can simply request a different local username to gain unauthorized access.