The restricted keyword in authorized_keys, designed to limit the capabilities of a specific key, was not enforced for tunnel forwarding in OpenSSH releases older than 10.5. As a result, a key marked as restricted could still be used to open SSH tunnels, permitting an attacker to route traffic through the host without proper authorization. This represents a weakness in channel access control (CWE‑670) and an improper restriction of operations within software limits (CWE‑305).

OpenBSD OpenSSH is affected for any release before version 10.5. The specific version information is not detailed, but the change is documented in the 10.5 release notes, indicating that all previous releases contain the flaw.

The CVSS score of 2.5 classifies the issue as low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely abused. An attacker would need access to a restricted key to exploit the flaw, and though this does not allow arbitrary code execution, it can enable unauthorized port forwarding and potential lateral movement across the network. This is a weakness in channel access control (CWE‑670) and a failure to enforce proper operation limits (CWE‑305). Overall, the risk remains low but should be mitigated promptly.