CVE-2026-83540: CWE-287 Improper Authentication in wolfSSL wolfSSH

This vulnerability arises from improper handling of Windows logon tokens in the Windows port of wolfSSHd. When password or public key authentication is used, the logon token from a prior authenticated session is retained and reused improperly for subsequent sessions. This results in user login poisoning, enabling privilege escalation whereby a less privileged user can gain the identity and privileges of a more privileged user. The issue was introduced in version 1.4.15 and affects all versions through 1.5.0. Non-Windows versions of wolfSSHd are unaffected. The CVSS 4.0 base score is 7.7, indicating high severity with network attack vector, low attack complexity, and partial privileges required.

An attacker with a valid account on a vulnerable Windows wolfSSHd server can exploit this vulnerability to escalate privileges by forcing a login as a more privileged user. This compromises authentication integrity and can lead to unauthorized access and potential further system compromise. The vulnerability does not affect non-Windows builds.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix links are provided, users should monitor wolfSSL advisories for updates. Until a fix is available, avoid using the Windows port of wolfSSHd in sensitive environments or restrict access to trusted users only.