Improper certificate validation in Apache MINA SSHD (CVE-2026-56624)

Apache MINA SSHD's server-side OpenSSH user certificate validation failed to check or validate the force-command and verify-required options that may be embedded in a user certificate. As a result, a user authenticating with a certificate containing a force-command option could bypass that restriction and execute other commands. The commands available to such a user depend on the specific server implementation. Affected versions: - Apache MINA SSHD (org.apache.sshd:sshd-core) 2.0.0 through 2.18.0 - Apache MINA SSHD (org.apache.sshd:sshd-core) 3.0.0-M1 through 3.0.0-M4 We recommend updating to: 2.19.0, 3.0.0-M5. CVSS 7.3 · our assessment: this_week Reference: https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6 Details: https://vuln.today/cve/CVE-2026-56624