OpenSSH Vulnerability CVE-2026-123158 Allows Password Bypass

## Overview A new vulnerability, CVE-2026-123158, has been disclosed affecting OpenSSH versions prior to 10.6p2. This issue arises when using musl libc without PAM on Linux systems. It allows for a password authentication bypass under specific conditions. ## Technical Details The vulnerability is linked to the way sshd interprets strings during the authentication process. When musl libc is deployed without PAM, the system misinterprets certain strings, failing to distinguish between a password and a password hash. This misinterpretation can lead to successful authentication with any password that is between 256 and 1024 characters long. This flaw particularly impacts configurations on platforms like Alpine Linux. ## Impact The high severity of this vulnerability, rated at CVSS 8.1, means that it poses a significant risk to systems running affected versions of OpenSSH. An attacker could exploit this flaw to gain unauthorized access to accounts, particularly if weak or predictable passwords are used. Organizations relying on OpenSSH for secure shell access should be aware of the potential for exploitation. ## Mitigation Defenders should upgrade to OpenSSH version 10.6p2 or later to mitigate this vulnerability. It is crucial to review configurations, especially on systems using musl libc without PAM, to ensure they are not inadvertently exposing accounts to this risk. Regular updates and security audits can help maintain the integrity of systems against such vulnerabilities.