A critical password authentication bypass in Alpine Linux's openssh-server allows attackers to log in without knowing any password by sending a long password string when certain account configurations are present. The vulnerability affects systems using openssh-server built without PAM (or with UsePAM disabled) that have PasswordAuthentication enabled and at least one key-only account alongside another account with a standard password hash. Immediate patching or disabling password logins is strongly recommended.
Background
OpenSSH is the standard secure shell implementation used across Linux distributions, including Alpine's lightweight musl-based environment. This advisory highlights a critical flaw specific to Alpine's default openssh-server packaging configuration.
- Source
- Lobsters
- Published
- Nov 7, 2026 at 10:51 PM
- Score
- 9.0 / 10