CVE-2026-93994

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.20.0 Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M5

Description The server code in the sshd-core component fails to enforce that multiple public keys presented during a multi-authentication scheme are distinct. This allows a user to bypass the requirement for two different key pairs by presenting the same single key twice, resulting in a partial authentication bypass.

Recommendations Upgrade to version 2.20.0. Upgrade to version 3.0.0-M6.