A race condition in the Windows port of wolfSSHd causes a Windows logon token acquired for one authenticated connection to persist until the next connection is established. This token reuse can lead to user login poisoning, permitting an attacker who authenticates with a lower‑privilege account to be logged in as a higher‑privilege user. The flaw corresponds to an authentication bypass weakness (CWE‑287) and a token reuse issue (CWE‑613), and, in this case, it applies to both password and public key authentication, meaning either method can be used to trigger the exploit.

WolfSSL’s wolfSSHd Windows server, version 1.4.15 through 1.5.0, is affected. Non‑Windows builds of wolfSSHd are not impacted.

The vulnerability has a CVSS score of 7.7 and is not listed in the CISA KEV catalog, with no EPSS data available. An attacker only needs a valid, less‑privileged account on the server and the ability to initiate an SSH session; the race condition is triggered between successive connections. Because the flaw can be exploited remotely via SSH, the potential impact spans confidentiality, integrity, and availability of the server by enabling unauthorized privilege escalation.