The vulnerability is an improper certificate validation flaw in the asyncssh.connect function within Cochise's SSH Host Key Handler. By manipulating input, an attacker can trick the component into accepting forged or unauthorized SSH host certificates, thereby bypassing authentication and enabling unauthorized access to services. This issue falls under CWE-287 and CWE-295, representing authentication bypass and improper verification of cryptographic signatures. The CVSS score of 6.3 indicates a moderate severity that can compromise confidentiality and integrity of data when exploited.

Vendor: andreashappe; Product: Cochise. All releases up to version 0.4.1 are affected. The flaw resides in the SSH Host Key Handler component of the asyncssh.connect function affected revision and apply updates accordingly.

The attack can be launched remotely and requires a high level of complexity, but the public exploitation effort is described as difficult. With a CVSS score of 6.3, the risk is moderate; however, the potential for unauthorized access encourages swift remediation. Public exploits are available, and the vulnerability is The EPSS score of 0.00264 indicates a very low probability of exploitation, but the presence of a public exploit means a non‑zero risk if systems remain vulnerable.