CVE-2026-93994
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
- Score
- CVSS 3.1 8.1 High
- Status
- Awaiting Analysis - security@apache.org
- Published
- 2026-09-30
- Last modified
- 2026-09-30
- Weaknesses
- CWE-304
Affected products
References
- https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp
- http://www.openwall.com/lists/oss-security/2026/09/29/33
