Apache MINA SSHD, a Java library for SSH client and server implementations, contains an authentication bypass vulnerability (CWE-305) in its sshd-core component. The flaw arises from a logic error in the asynchronous authentication feature, which is only used if explicitly implemented by the server. This error can cause the server to skip signature checks during public-key or hostbased authentication or return incorrect results, effectively bypassing authentication. The vulnerability affects versions >=2.0.0 <2.20.0 and >=3.0.0-M1 <3.0.0-M6. The Apache Software Foundation fixed this issue in versions 2.20.0 and 3.0.0-M6 by correcting the logic and disallowing asynchronous authentication with public-key or hostbased schemes, closing the session and logging an event if such usage is attempted.

Successful exploitation of this vulnerability allows an attacker to bypass authentication on an SSH server implemented with Apache MINA SSHD using asynchronous authentication with public-key or hostbased methods. This results in unauthorized access with full confidentiality and integrity impact, as indicated by the CVSS score of 9.1 (critical). There is no known exploitation in the wild at this time.

Users should upgrade affected Apache MINA SSHD versions to 2.20.0 or 3.0.0-M6 or later, where the vulnerability is fixed. These versions correct the authentication logic and prevent asynchronous authentication from being used with public-key or hostbased authentication schemes. If upgrading is not immediately possible, avoid using asynchronous authentication with public-key or hostbased methods. The vendor advisory indicates these fixes are official and complete.