A flaw in the LDAP integration of Apache MINA SSHD allows an attacker to supply the literal values "*" for both the username and password, causing the server to authenticate successfully without credentials. The lack of proper escaping of LDAP filter metacharacters means the authentication decision is compromised, giving an adversary unauthorized access that can be used to exfiltrate data or launch further attacks. The vulnerability is classified as a severe authentication bypass, reflected in a 9.1 CVSS score, and poses a risk to confidentiality, integrity, and availability of the SSH service.

The issue affects Apache MINA SSHD deployments that employ the optional sshd-ldap module in versions 1.2.0 through 2.19.0 and 3.0.0‑M1 through 3.0.0‑M5 when that module is enabled for password or public‑key authentication. Systems that do not use sshd‑ldap or keep it disabled are not impacted.

The high CVSS score and the nature of the flaw indicate a significant threat surface. The exploit requires remote access to the SSH server and the presence of the vulnerable module; no local privileges are needed. While the EPSS score is not provided, the lack of listing in the CISA KEV catalog suggests the vulnerability has not yet seen widespread exploitation, but the potential for unauthenticated remote bypass remains substantial.