Withdrawn Advisory
This advisory was withdrawn on Aug 24, 2026. Withdrawn advisories are no longer considered active.
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
0.9.6-10.9.6-1build10.9.6-20.9.6-2build10.9.6-2ubuntu0.22.04.10.9.6-2ubuntu0.22.04.20.9.6-2ubuntu0.22.04.30.9.6-2ubuntu0.22.04.40.9.6-2ubuntu0.22.04.50.9.6-2ubuntu0.22.04.6+1 more0.10.5-3ubuntu10.10.5-3ubuntu20.10.6-20.10.6-2build10.10.6-2build20.10.6-2ubuntu0.10.10.6-2ubuntu0.20.10.6-2ubuntu0.30.10.6-2ubuntu0.40.11.2-1build10.11.3-10.11.3-1ubuntu10.11.3-1ubuntu20.6.3-3ubuntu30.6.3-4.10.6.3-4.20.6.3-4.2ubuntu10.6.3-4.30.6.3-4.3ubuntu0.10.6.3-4.3ubuntu0.20.6.3-4.3ubuntu0.50.6.3-4.3ubuntu0.60.6.3-4.3ubuntu0.6+esm1+4 more0.7.5-10.8.0~20170825.94fa1e38-10.8.0~20170825.94fa1e38-1build10.8.0~20170825.94fa1e38-1ubuntu0.10.8.0~20170825.94fa1e38-1ubuntu0.20.8.0~20170825.94fa1e38-1ubuntu0.50.8.0~20170825.94fa1e38-1ubuntu0.60.8.0~20170825.94fa1e38-1ubuntu0.70.8.0~20170825.94fa1e38-1ubuntu0.7+esm30.8.0~20170825.94fa1e38-1ubuntu0.7+esm4+3 more0.9.0-1ubuntu10.9.0-1ubuntu40.9.0-1ubuntu50.9.3-2ubuntu10.9.3-2ubuntu20.9.3-2ubuntu2.10.9.3-2ubuntu2.20.9.3-2ubuntu2.30.9.3-2ubuntu2.40.9.3-2ubuntu2.5+4 moreExploitability
AV:NAC:LPR:LUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H