Threats affecting pkg:maven/org.apache.sshd/sshd-core

CVE-2026-77185 is a critical authentication bypass vulnerability in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. It affects the asynchronous authentication mechanism in the sshd-core component, potentially allowing signature checks to be skipped in public-key or hostbased authentication. The flaw arises from a logic error in the implementation of asynchronous authentication, which must be explicitly used by the server. Fixed in versions 2.20.0 and 3.0.0-M6, these updates also restrict asynchronous authentication to password or keyboard-interactive methods only, closing sessions if misused.

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Apache MINA SSHD versions 2.0.0 through 3.0.0-M1 contain a vulnerability in server-side OpenSSH user certificate validation. The server did not properly check or validate unsupported force-command or verify-required options embedded in user certificates. This allowed a user to authenticate with a certificate containing a force-command option but still execute other commands, depending on server implementation. The issue is fixed in versions 2.19.0 and 3.0.0-M5 by rejecting such certificates.