CVE-2026-77185

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result. Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.

• CWE-305

• https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n
• https://www.openwall.com/lists/oss-security/2026/09/29/32

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77177Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Met…9.8
• CVE-2026-77179On macOS, the virtio-fs host server used by Docker Sandboxes…9.4
• CVE-2026-7718A vulnerability was identified in Totolink WA300 5.2cu.7112_…6.3
• CVE-2026-77180When NGINX Ingress Controller is configured with Ingress ann…8.3
• CVE-2026-77181Incorrect Authorization vulnerability in Apache Syncope. …9.8
• CVE-2026-77184In MongoDB Connector for BI, the description text of a colle…5.2
• CVE-2026-77186The My Calendar – Accessible Event Manager plugin for WordPr…6.4
• CVE-2026-77187The My Calendar – Accessible Event Manager plugin for WordPr…6.4
• CVE-2026-77189The Charitable – Donation & Fundraising Platform (Donation F…6.5
• CVE-2026-7719A security flaw has been discovered in Totolink WA300 5.2cu.…9.8
• CVE-2026-77190On affected platforms running Arista EOS, an unauthenticated…6.5
• CVE-2026-77191An authenticated supplicant on an adjacent network may bypas…2.6