CVE-2026-60001
openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 8, 2026
Updated · October 30, 2026
Description
A flaw was found in OpenSSH's SSH daemon (sshd). A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attacker to guess valid credentials, potentially leading to unauthorized access or a denial of service.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-307 · Improper Restriction of Excessive Authentication Attempts