EUVD-2026-93997
GHSA-2xxv-m3rc-rvrm
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
GSSAPI must be enabled (non-default) and credentials recovered locally, so AV:L/AC:H/PR:L/UI:R; only residual credential exposure, hence C:L and I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
AnalysisAI
Credentials may persist in sshd after a failed GSSAPIAuthentication attempt in OpenSSH before 10.6, potentially leading to low-impact information disclosure. This issue requires GSSAPIAuthentication to be enabled (not the default), a local low-privilege attacker with an existing foothold, and user interaction; it cannot be exploited remotely or without authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that GSSAPIAuthentication be enabled in sshd_config (this is NOT the OpenSSH default, which is 'no'), a GSSAPIAuthentication attempt that fails, and the running OpenSSH version being before 10.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to a genuinely low-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenSSH 10.6 or later; the release notes at https://www.openssh.org/releasenotes.html#10.6 document the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today