In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
Fix
Vendor advisories in the News 1
- USN-8928-1: OpenSSH vulnerabilities Ubuntu Security Notices · 2026-10-14
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · openbsdNVD modified 2026-10-13 14:59
Affected (CPE criteria) 1
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
References 1
- https://www.openssh.org/releasenotes.html#10.6 Release Notes