Rucio contains a critical vulnerability where SSH challenge tokens, intended as short-lived nonces for SSH key exchange, are mistakenly accepted as valid authentication tokens. This flaw allows an unauthenticated attacker to request a challenge token for any account, including administrative ones, and use it to impersonate that account to access API endpoints. The vulnerability affects multiple versions of Rucio prior to fixed releases. A high-severity CVSS 3.1 score of 9.8 reflects the critical impact of this issue.