PT-2026-134954

Published

2026-05-22

·

Updated

2026-05-22

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Vendors
Affected products
Related identifiers
AZL-111602
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com