The bug in OpenSSH versions prior to 10.4 originates from incorrect precedence handling between the configuration options DisableForwarding=yes and PermitTunnel=yes. Instead of correctly suppressing tunneling when DisableForwarding is asserted, the daemon honors PermitTunnel, allowing users to establish SSH tunnels even though forwarding is supposedly disabled. This is a configuration logic flaw that permits a bypass of intended restriction and can provide an attacker with an unauthorized channel for lateral movement or data exfiltration, as indicated by CWE-348 and CWE-358.

The vulnerability affects the OpenSSH daemon provided by OpenBSD in any version older than 10.4, as indicated by the vendor data. No other vendors or products are listed as affected, so the scope is limited to this OpenSSH project.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of a very low probability of exploitation at this time. The flaw is not included in CISA’s KEV catalog, suggesting no widespread or publicly known exploits. Based on the description, it is inferred that the attack vector requires an authenticated SSH connection that includes the PermitTunnel option; an attacker who can DisableForwarding setting.