Loading vulnerability…
Authentication Bypass in Apache MINA SSHD Asynchronous Authentication
CVE-2026-77185 is an authentication-bypass vulnerability in the server-side asynchronous-authentication mechanism of Apache MINA SSHD's sshd-core component. It affects versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5. In SSH servers containing explicit code that uses asynchronous authentication, a logic error can cause signature verification for public-key or host-based authentication to be skipped, or an incorrect authentication result to be returned. This can allow unauthorized authentication. Merely using an affected library version does not establish exploitability; the server must implement the affected authentication mechanism.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker may bypass SSH authentication and gain unauthorized access to services exposed by the affected server. Successful exploitation can compromise confidentiality and integrity within the permissions and capabilities available to the accepted identity. Arbitrary command execution or full host compromise is not established and depends on the SSH services the application exposes.
If you can’t patch tonight, do this now.
Do not use asynchronous authentication with public-key or host-based authentication. Restrict asynchronous authentication to password or keyboard-interactive schemes until a fixed release is deployed.
Patch, then assume compromise.
Upgrade Apache MINA SSHD to version 2.20.0 or a later fixed 2.x release, or to 3.0.0-M6 or a later fixed 3.x release. These versions correct the authentication logic and prohibit asynchronous authentication with public-key or host-based schemes, closing the SSH session and logging the unsupported use. Update application authentication implementations accordingly. For vendor-packaged or embedded deployments, install the applicable vendor update incorporating the fix.
No public exploits tracked yet. Mallory keeps watching.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.