Aller au contenu
en Se connecter
8.1 Élevée

CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH

Description

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Mina SSHD 3.0 3.0.0-M1 → < 3.0.0-M6 3.0.0-M6
Apache Mina SSHD 2.20 premières → < 2.20.0 2.20.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Mina SSHD

Les 17 CVE de Apache Mina SSHD →
CVE-2026-77185 Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain… 9.1 Critique CVE-2026-94053 Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and… 9.1 Critique CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 6.5 Moyenne CVE-2026-93996 Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 6.5 Moyenne
Suivre cette CVE