The flaw resides in the getRevokedKeys() method of KnownHosts.java in mwiede’s jsch library up to version 2.28.5. Manipulating the known_hosts argument bypasses the check that should discard revoked certificates, allowing an attacker to trick the client into trusting a compromised key. The public information indicates the exploit can be performed remotely, but it requires high‑complexity steps and is considered difficult to execute.

The affected vendor is mwiede and the product is jsch, specifically all releases up to and including 2.28.5. Upgrading to 2.28.6 removes the vulnerability.

The vulnerability carries a CVSS score of 6.3 and is not listed in the CISA KEV catalog. EPSS information is not available. While the exploit is difficult, it has been released publicly, meaning attackers with sufficient skill could attempt to supply a suspicious known_hosts file and bypass revocation checks. The threat is primarily to the integrity of the TLS/SSH key trust chain rather than direct code execution.