Skip to content
fr Sign in
9.1 Critical

CVE-2026-94052 A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or…

Description

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator. Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

Affected products and versions

Product Affected versions Fixed in
Apache Mina SSHD 3.0 3.0.0-M1 → < 3.0.0-M6 3.0.0-M6
Apache Mina SSHD 1.2 1.2.0 → < 2.20.0 2.20.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Mina SSHD

The 17 CVEs of Apache Mina SSHD →
CVE-2026-77185 Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain… 9.1 Critical CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH 8.1 High CVE-2026-94053 Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and… 9.1 Critical CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 6.5 Medium
Track this CVE