SFTP authentication bypass via empty password in goshs (CVE-2026-62325)

goshs contains a logic error in its SFTP password handler setup where a boolean `&&` operator causes the `PasswordHandler` to remain unset when either the username or password field is empty. When started with `-b 'user:' -sftp` and no `-fkf` flag, gliderlabs/ssh receives no authentication handlers and enables unauthenticated access, allowing any client to connect without credentials. This is an incomplete fix of CVE-2026-40884, which addressed only the empty-username variant via input validation without correcting the underlying root cause in `sftpserver.go`. Public POC available. Affected versions: - >=v2.1.3 We recommend updating to: v2.1.4. CVSS 9.1 · our assessment: act_now Reference: https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm Details: https://vuln.today/cve/CVE-2026-62325