CVE-2026-39831

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The Verify() method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com failed to check the User Presence flag. This allows signatures generated without physical touch to be accepted, enabling the unattended use of a hardware security key.

Recommendations Return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback to restore the previous behavior.