The flaw is in the asynchronous authentication feature of Apache MINA SSHD. It can allow an attacker to bypass signature verification in public-key or hostbased authentication, effectively bypassing user identity checks and enabling unauthorized SSH logins. This creates a serious threat to confidentiality and integrity of the target system and can be leveraged to gain privileged remote access.

The vulnerability affects versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 of the Apache MINA SSHD Java library. Any application that incorporates these library versions and enables the asynchronous authentication mechanism is at risk. The library is maintained by the Apache Software Foundation.

With a CVSS score of 9.1 the severity is critical. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog. The attack vector is the SSH protocol; an attacker must be able to initiate an SSH session and exploit a server that has implemented asynchronous authentication for public-key or hostbased methods. If such a server is exposed to the network, remote exploitation is feasible and would result in an unauthenticated or unauthorised session. The flaw is considered rare in practice, yet its impact justifies immediate action.