https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T19:46:23.393697+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-93994 fkie_cve-2026-93994 2026-10-01T19:46:23.396419+00:00

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

 https://vulnerability.circl.lu/vuln/ghsa-qc4p-9828-mv83 GHSA-qc4p-9828-mv83 2026-10-01T19:46:23.396505+00:00

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

 https://vulnerability.circl.lu/vuln/rhsa-2026:71541 RHSA-2026:71541 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-01T19:46:23.396533+00:00

org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93994 UBUNTU-CVE-2026-93994 2026-10-01T19:46:23.396560+00:00

Affected: Ubuntu:16.04:LTS: mina, Ubuntu:16.04:LTS: mina2, Ubuntu:18.04:LTS: mina, Ubuntu:18.04:LTS: mina2, Ubuntu:20.04:LTS: mina, Ubuntu:20.04:LTS: mina2, Ubuntu:22.04:LTS: mina, Ubuntu:Pro:22.04:LTS: mina2, Ubuntu:24.04:LTS: mina, Ubuntu:Pro:24.04:LTS: mina2 and 1 more

[Unknown description]