CVE-2026-94052

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 1.2.0 through 2.19.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5

Description A missing check in the LdapPasswordAuthenticator function within the sshd-ldap component allows attackers to bypass password authentication. This issue specifically affects SSH servers that use the optional sshd-ldap component and have configured LdapPasswordAuthenticator for password authentication. Standard password authentication provided by the sshd-core mechanisms is not affected.

Recommendations Upgrade Apache MINA SSHD versions 1.2.0 through 2.19.0 to version 2.20.0. Upgrade Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5 to version 3.0.0-M6.