Threats affecting pkg:maven/Maverick Synergy Server

Jadaptive Maverick Synergy Server versions before 3.0.33 and 3.1.7, and Maverick Legacy Server before 1.8.1, have an authentication bypass vulnerability in SSH public key authentication. The flaw allows reuse of cached key authorization decisions across different usernames on the same connection, enabling attackers with a key authorized for one account to authenticate as another user. This vulnerability has a high severity score of 8.7 CVSS 4.0 and has been fixed in versions 3.0.33, 3.1.7, and 1.8.1.

CVE-2026-127091 is a vulnerability in Jadaptive Maverick Synergy Server and Maverick Legacy Server that allows authenticated users to bypass mount-level access controls by exploiting improper path equivalence resolution. This flaw exists in versions before 3.0.33 and 3.1.7 of Maverick Synergy Server, and before 1.8.1 of Maverick Legacy Server. Attackers can use specially crafted paths containing duplicate separators or dot segments to access files or directories that should be restricted by parent mount policies.