A vulnerability in the russh SSH client library allows a malicious SSH server, whose host key is ultimately rejected, to trigger the client's kex_done() callback with the raw key-exchange shared secret before server host-key verification occurs. This callback is intended for protocol bridging such as VPN-over-SSH or secondary encrypted channels. Because kex_done() runs before check_server_key(), an untrusted server can cause application-defined actions based on the shared secret even though the connection is later rejected.