The vulnerability in Erlang/OTP SSH (CVE-2026-48859) involves an observable timing discrepancy during password authentication. When configured with the user_passwords or password options, ssh_auth:check_password/3 performs a PBKDF2-SHA256 hash with 600,000 iterations (~300ms) for valid usernames but returns immediately (~0ms) for invalid usernames via ssh_options:get_password_option/2. This timing difference allows unauthenticated remote attackers to distinguish valid usernames from invalid ones in a single authentication attempt. The issue affects OTP versions 29.0 prior to 29.0.2 and SSH versions 6.0 prior to 6.0.1. The user_passwords and password options are intended for testing; the recommended pwdfun option is not vulnerable.

An unauthenticated remote attacker can enumerate valid usernames on the SSH service by measuring authentication response times. This information disclosure can aid further targeted attacks such as brute force or social engineering. The vulnerability does not allow direct password compromise or code execution but leaks sensitive authentication information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects OTP versions before 29.0.2 and SSH versions before 6.0.1. Users should upgrade to OTP 29.0.2 or later and SSH 6.0.1 or later once available. Alternatively, avoid using the user_passwords or password options for SSH authentication and switch to the recommended pwdfun option, which is not affected by this timing discrepancy.