CVE-2026-93994

A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell (SSH) public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key authentication requirements. This flaw results in an authentication bypass, allowing an attacker to gain unauthorized access using fewer credentials than mandated by the security policy.

A flaw was found in Apache MINA SSHD's authentication implementation in the sshd-core component. When an SSH server is configured to require multi-factor authentication using two different public keys (configured as AuthenticationMethods "publickey,publickey" in OpenSSH or equivalent in Apache MINA SSHD), the server does not validate that the two public keys presented during authentication are actually different. An attacker who possesses one valid SSH key authorized for an account can successfully authenticate by presenting the same key twice, bypassing the requirement for a second key. This is a partial authentication bypass that completely negates the security benefit of multi-key authentication configurations.

Red Hat ships vulnerable versions of Apache MINA SSHD in JBoss EAP 7/8/XP, JBoss Fuse 7 (Extended Lifecycle Support), Red Hat SSO 7, OpenShift Tools 4.x, Red Hat build of Apache Camel (Quarkus and Spring Boot variants), and RHEL-based Java packages. Fixed version 2.20.0 is available, which addresses this issue by enforcing that two distinct public keys must be presented for multi-key authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, if using Apache MINA SSHD with multi-key authentication configured, consider implementing additional authentication mechanisms (password, OTP) or restricting SSH access to trusted networks until patches are applied.