What is the CVSS score of CVE-2025-5689?

CVE-2025-5689 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of SSH are affected by CVE-2025-5689?

CVE-2025-5689 allows first-time SSH users to gain root-level privileges on affected systems, creating a critical unauthorized access vulnerability.. A patch is available.

How to fix or mitigate CVE-2025-5689?

Within 24 hours: Identify all systems running authd with vulnerable NSS configurations and restrict SSH access to trusted networks only. Within 7 days: Apply the available vendor patch to all affected systems, prioritizing production and sensitive infrastructure. Within 30 days: Conduct post-patch verification testing and audit logs for any unauthorized first-time user logins with elevated privileges.

SSH CVE-2025-5689

EUVD-2025-18385 HIGH

Improper Privilege Management (CWE-269)

2025-06-16 security@ubuntu.com

GHSA-g8qw-mgjx-rwjr

Authentication Bypass Privilege Escalation Linux SSH Authd Suse

8.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18385

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

Patch released

Mar 14, 2026 - 21:59 nvd

Patch available

CVE Published

Jun 16, 2025 - 12:15 nvd

HIGH 8.5

DescriptionNVD

A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session.

AnalysisAI

Privilege escalation flaw in authd's temporary user record handling during pre-authentication NSS operations that causes first-time SSH login users to be incorrectly assigned root group membership within their session context. This allows authenticated users (PR:L) to gain elevated group privileges over the network (AV:N) with low complexity, affecting system confidentiality (C:H) and integrity (I:L). The vulnerability has a high CVSS score of 8.5, though real-world exploitation requires valid login credentials and depends on authentication infrastructure specifics.

Technical ContextAI

The vulnerability exists in authd (authentication daemon) and its interaction with NSS (Name Service Switch) during the pre-authentication phase. Specifically, when authd creates a temporary user record for first-time SSH authentication, it incorrectly initializes group memberships to include the root group (GID 0). This is a CWE-269 (Improper Access Control / Unintended Access) issue where the access control logic fails to properly restrict group membership assignment. The flaw manifests in the NSS layer responsible for user and group lookups during SSH authentication, meaning the vulnerability affects any system using authd with SSH that relies on dynamic user provisioning or first-time user authentication scenarios. The root cause appears to be insufficient validation or initialization of group context in the temporary user record structure before it is made available to the authentication context.

RemediationAI

Immediate remediation steps: (1) Patch authd to the latest patched version from your distribution vendor (check RedHat Security Advisories, Debian Security Tracker, or your vendor's bulletin for CVE-2025-5689). (2) Until patching, implement workarounds by restricting SSH access to known users only (disable password authentication if possible, use key-based auth with restricted authorized_keys). (3) Review and restrict sudo/group membership policies to minimize blast radius if a first-time user gains elevated group access. (4) Monitor authd logs and SSH authentication logs for first-time user logins and unexpected group assignments. (5) Consider disabling first-time user auto-provisioning features if feasible. (6) Apply the patch through standard distribution update channels (yum update authd, apt-get update && apt-get upgrade authd, or equivalent). Verify patch application by checking authd version post-update and testing first-time user authentication in a controlled environment.