CVE-2026-77185

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Published Sep 30, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server.

Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result.

Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.

Analysis

Technical impact

The flaw is in the asynchronous authentication feature of Apache MINA SSHD. It can allow an attacker to bypass signature verification in public-key or hostbased authentication, effectively bypassing user identity checks and enabling unauthorized SSH logins. This creates a serious threat to confidentiality and integrity of the target system and can be leveraged to gain privileged remote access.

Affected Systems

The vulnerability affects versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 of the Apache MINA SSHD Java library. Any application that incorporates these library versions and enables the asynchronous authentication mechanism is at risk. The library is maintained by the Apache Software Foundation.

Risk and Exploitability

With a CVSS score of 9.1 the severity is critical. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog. The attack vector is the SSH protocol; an attacker must be able to initiate an SSH session and exploit a server that has implemented asynchronous authentication for public-key or hostbased methods. If such a server is exposed to the network, remote exploitation is feasible and would result in an unauthenticated or unauthorised session. The flaw is considered rare in practice, yet its impact justifies immediate action.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache MINA SSHD

unaffected

Version	Status	Constraints
`2.0.0`	affected	< 2.20.0
`3.0.0-M1`	affected	< 3.0.0-M6

No data.

Vendor Product Versions

Apache

Mina Sshd

Version	Status	Scheme	Platform
`[2.0.0,2.20.0)`	affected	semver	—
`[3.0.0-M1,3.0.0-M6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Apache MINA SSHD library to version 2.20.0 or 3.0.0-M6, which corrects the logic error and prevents use of asynchronous authentication with public-key or hostbased schemes.
Configure the SSH server to disable the asynchronous authentication mechanism entirely or restrict it to password or keyboard‑interactive authentication; the server will close the session and log an entry if misuse is attempted.
Verify server configuration and logs for any evidence of asynchronous authentication being triggered with public-key or hostbased methods, and adjust code accordingly to ensure the updated logic is in effect.

Generated by OpenCVE AI on September 30, 2026 at 11:47 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.552% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/29/32
https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 30, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache mina Sshd
Vendors & Products		Apache Apache mina Sshd

Sep 30, 2026 11:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/09/29/32

Sep 30, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.
Title		Apache MINA SSHD: Asynchronous authentication can bypass signature verification
Weaknesses		CWE-305
References		https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`