Net::LibSSH versions prior to 0.004 do not verify the host key when establishing an SSH session. The connect routine declares success as soon as libssh reports SSH_OK, while the binding never performs a known‑hosts check. Consequently, any authentication method – password, agent or public‑key – proceeds without identifying the peer. An attacker who can redirect the client connection to a malicious server can capture the password used for authentication and can also send and receive data over the session, potentially executing arbitrary commands.

All installations of the Perl module Net::LibSSH that use a version earlier than 0.004 are affected. Any Perl application or script that relies on this library for SSH connectivity is at risk while using these vulnerable releases.

The lack of host key verification results in a high‑risk authentication bypass that can lead to credential theft and command execution on the client system. The CVSS score of 9.1 indicates critical severity. Exploitation requires the attacker to redirect or intercept the SSH connection, which is feasible for network adversaries that control traffic to the client. The vulnerability carries a CWE-322 identifier, an EPSS score of < 1%, and is not listed in the CISA KEV catalog, but the potential impact warrants urgent attention.