CVE-2026-123158

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.6p2

Description An authentication bypass exists in sshd on Linux systems using musl libc without PAM. The issue arises from a misinterpretation of whether a string is intended to be a password hash. Specifically, the crypt() function in musl libc returns a * for any password exceeding 256 bytes. If a locked account also has a * in its shadow field, sshd compares these two values and considers them a match. Consequently, for certain account configurations, any password between 256 and 1024 characters allows successful authentication.

Recommendations Update to OpenSSH version 10.6p2. Disable password authentication until the update is applied.