CVE-2026-123158

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.6p2

Description When running on Linux with musl libc and without PAM, the sshd service contains a flaw that allows a password authentication bypass. This occurs because the crypt() function in musl libc returns a * for any password exceeding 256 bytes. Since locked accounts also use * in their shadow field, the system incorrectly matches the input, allowing access for any password between 256 and 1024 characters for certain account configurations.

Recommendations Update to OpenSSH version 10.6p2.