This vulnerability involves incorrect authorization (CWE-863) in the golang.org/x/crypto/ssh package. Specifically, if an SSH server configuration uses a callback type other than public key, the source-address validation step is skipped, potentially allowing unauthorized access. This issue is related to a previously fixed vulnerability (CVE-2024-45337) but affects other callback types not covered by that fix. No CVSS score or patch information is provided, and no known exploits have been reported.

The impact is an authorization bypass in SSH server configurations using golang.org/x/crypto/ssh when non-public key callbacks are used. This could allow unauthorized users to bypass source-address validation checks, potentially leading to unauthorized access depending on the server's configuration. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review SSH server callback configurations and avoid using non-public key callbacks that could bypass source-address validation. Monitor golang.org/x/crypto project advisories for updates.