Search: CVE-2026-56624

Apache MINA SSHD versions 2.0.0 through 3.0.0-M1 contain a vulnerability in server-side OpenSSH user certificate validation. The server did not properly check or validate unsupported force-command or verify-required options embedded in user certificates. This allowed a user to authenticate with a certificate containing a force-command option but still execute other commands, depending on server implementation. The issue is fixed in versions 2.19.0 and 3.0.0-M5 by rejecting such certificates.