Technical impact
The vulnerability in Apache MINA SSHD allows an attacker to authenticate by presenting the same public key twice when the server is configured to require two distinct keys. Because the server does not enforce key uniqueness, the attacker bypasses the intended multi‑authentication requirement, gaining unauthorized access to the SSH account. This flaw falls under CWE‑303 and CWE‑304, weaknesses that permit authentication bypass.
Affected Systems
Apache MINA SSHD, versions up to and including 2.19.0 and 3.0.0‑M1 through 3.0.0‑M5, are affected. Users should verify the specific build installed and consider it vulnerable if it falls within these ranges.
Risk and Exploitability
The CVSS score of 8.1 indicates high severity. Although the EPSS score is below 1%, indicating a low but non-zero exploitation probability, the absence of a KEV listing does not diminish the risk; the flaw is exploitable over the network via standard SSH authentication attempts. An attacker with network access can attempt to authenticate by replaying a single key, thus bypassing the multi-authentication policy. The vulnerability is readily exploitable with no special privileges required beyond the ability to initiate SSH login attempts.
