This vulnerability involves incorrect authorization handling in the golang.org/x/crypto/ssh package. Specifically, when an SSH server authentication callback returns PartialSuccessError along with non-nil Permissions, the permissions were discarded silently, potentially bypassing certificate restrictions like force-command after multi-factor authentication. The fix changes this behavior to cause a connection error instead of silently ignoring permissions, preventing the bypass.

The impact is that certificate restrictions intended to enforce additional command or session constraints may be bypassed after a second factor authentication succeeds, potentially allowing unauthorized actions that should have been restricted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when relying on certificate restrictions in this package and monitor for vendor updates.