The golang.org/x/crypto/ssh package contains a vulnerability in its Verify() method for FIDO/U2F security keys (specifically sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com). The method does not verify the User Presence flag, which is intended to require physical user interaction (touch) on the hardware key. As a result, signatures generated without this physical touch are accepted, enabling potential unauthorized use of the hardware security key without user presence. The vulnerability allows bypassing authentication controls relying on physical user presence. The recommended workaround is to explicitly return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback to restore prior behavior. No official patch or fix has been documented yet.

This vulnerability allows an attacker or automated process to use a hardware security key without requiring physical user presence, effectively bypassing a security control designed to prevent unattended use. This could lead to unauthorized authentication if an attacker gains access to the system or key. However, there are no known exploits in the wild at this time. The impact is limited to scenarios relying on the affected Verify() method for enforcing user presence with FIDO/U2F keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, users can mitigate the issue by returning a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback to restore the previous behavior that enforces user presence. Monitor official golang.org/x/crypto advisories for updates and patches.