Threats Tagged 'cve-2026-54590'

The asyncssh library has an incomplete fix for CVE-2026-45309, allowing a bypass of username sanitization in the AuthorizedKeysFile path. The fix in version 2.23.0 blocks usernames containing '/', '\', or '..' before substitution, but does not block leading '~' or environment variable expansions, which are later expanded and can escape the intended directory. This allows an attacker to redirect authorized-keys file lookup to another user's home directory by using a username like '~root'. The vulnerability impacts authentication by allowing pre-auth access to an attacker-controlled authorized-keys file if the server's AuthorizedKeysFile configuration starts with '%u'. A patch is available to address this issue.

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.