The vulnerability occurs in libcurl-based applications performing SCP or SFTP transfers that use the CURLOPT_SSH_KEYFUNCTION callback. If the server presents a host key type that does not match the recorded key type in the known_hosts file, the callback mechanism does not reject the connection as expected. Instead, it allows the connection to succeed silently, bypassing the intended host key verification. This flaw undermines the security of SSH host key validation and may enable man-in-the-middle attacks by accepting untrusted servers without alerting the client.

Affected applications may unknowingly connect to untrusted or malicious servers due to improper host key type verification. This can lead to man-in-the-middle attacks where an attacker intercepts or alters data during SCP or SFTP transfers. The vulnerability compromises the trust model of SSH host key validation in libcurl when using the specific callback.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying solely on the CURLOPT_SSH_KEYFUNCTION callback for host key verification or implement additional verification mechanisms outside of libcurl. Monitoring vendor channels for updates is recommended.