Skip to content
Connect AISign inSign up free
CVE-2026-771859.1CriticalCWE-305

CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Apache Software Foundation · Apache MINA SSHD

Fixed in SLES 15 SP7 · Affected: Apache Software Foundation Apache MINA SSHD · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check
0.6%probability of exploitation in the next 30 days
46th percentile
050100

Higher than 46% of scored CVEs

9.1CriticalCVSS 3.1
LowCrit.

DescriptionNVD

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas
Exploitation
Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV
Not listed
Public check
No public nuclei template
Weakness
Authentication Bypass by Primary Weakness · Authentication
Vendor
Apache Software Foundation
Published
September 2026
Band
Unlikely (under 1%), September 2026

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Debian status tracked since 5 Nov 2026. Red Hat status tracked since 5 Nov 2026. SUSE status tracked since 5 Nov 2026. Ubuntu status tracked since 12 Nov 2026.

  1. Ubuntu’s tracker lists Ubuntu 16.04 as under investigation Ubuntu
  2. Ubuntu’s tracker lists Ubuntu 18.04 as under investigation Ubuntu
  3. Ubuntu’s tracker lists Ubuntu 20.04 as under investigation Ubuntu
  4. Ubuntu’s tracker lists Ubuntu 22.04 as under investigation Ubuntu
  5. Ubuntu’s tracker lists Ubuntu 24.04 as under investigation Ubuntu
  6. Ubuntu’s tracker lists Ubuntu 26.04 as under investigation Ubuntu
  7. Ubuntu’s tracker lists Ubuntu stonking as under investigation Ubuntu
  8. Debian’s tracker lists Debian 13 as affected, with no fix released Debian
  9. Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
  10. Red Hat’s tracker lists RHEL 7 as under investigation Red Hat
  11. Red Hat’s tracker lists RHEL 8 as under investigation Red Hat
  12. Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
  13. SUSE’s tracker lists SLES 15 SP2 as affected, with no fix released SUSE
  14. SUSE’s tracker lists SLES 15 SP3 as affected, with no fix released SUSE
  15. Seen in SUSE’s tracker on 5 Nov: SLES 15 SP7 fixed in apache-sshd-2.20.0-150200.5.19.1 SUSE

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 1 Oct.

  1. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Sign inSign up free

Updated