CVE-2026-77185

A flaw was found in Apache MINA SSHD. When a Secure Shell (SSH) server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to bypass authentication and gain unauthorized access to the server.

Red Hat rates this flaw as Important rather than the upstream Critical severity because exploitation requires the SSH server to have been explicitly implemented using the "asynchronous authentication" mechanism in Apache MINA SSHD - a feature the upstream advisory itself describes as "presumed rare". Since this is a specialized, opt-in configuration that the attacker cannot control, Red Hat has adjusted the CVSS Attack Complexity (AC) from Low to High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.