OpenSSH prior to version 10.3 contains a vulnerability (CVE-2026-35414) due to improper handling of the authorized_keys principals option when used with a principals list and a Certificate Authority that employs comma characters. This results from an always-incorrect control flow implementation (CWE-670), potentially causing incorrect authorization decisions. The CVSS 3.1 base score is 4.2, reflecting low confidentiality and integrity impacts with high attack complexity and requiring low privileges without user interaction.

The vulnerability may allow an attacker with low privileges to cause limited unauthorized disclosure or modification of information due to incorrect processing of principals in authorized_keys. There is no impact on availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the OpenBSD vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of principals lists with Certificate Authorities that utilize comma characters in authorized_keys or apply any recommended workarounds from the vendor.