CVE-2026-60001 describes a vulnerability in OpenSSH prior to version 10.4 where the sshd daemon does not always honor the configured minimum authentication delay. This behavior corresponds to CWE-770, indicating allocation of resources without limits or throttling. The vulnerability could allow an attacker to cause increased resource consumption by bypassing intended authentication delays, potentially impacting availability. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or official remediation level has been disclosed by the vendor as of the publication date.

The vulnerability can lead to increased resource consumption on the sshd service by bypassing the minimum authentication delay, potentially degrading service availability. There is no direct confidentiality impact, but integrity and availability impacts are rated as low. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for unusual authentication request patterns and consider implementing external rate limiting or connection throttling mechanisms if feasible.