The flaw lies in the sshd daemon of OpenSSH releases before 10.4, where the configured minimum authentication delay is not consistently enforced. An attacker can submit authentication attempts at a rate higher than allowed, effectively speeding up brute‑force login attacks and accelerating account compromise. The underlying weakness is a timing and logic error (CWE‑307) worsened by insufficient resource control (CWE‑770).

This vulnerability impacts every OpenBSD OpenSSH installation whose version precedes 10.4. Only the sshd component is affected, but it is exposed via the standard SSH port, making all systems routinely reachable by remote actors when the service is enabled.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% points to a very low but non‑zero chance of exploitation. The issue does not appear in the CISA KEV catalog. Attackers could exploit it over the network by sending rapid authentication attempts to sshd, bypassing the intended delay, thereby increasing the probability of successful credential guessing or enumeration.