Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:16:35 +0000 CVE-2026-39831 — Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh https://vulnerability.circl.lu/vuln/cve-2026-39831 <p><strong>Affected:</strong> golang.org/x/crypto/ssh</p> <p>The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a &#34;no-touch-required&#34; extension in Permissions.Extensions from PublicKeyCallback.</p> <p><strong>Affected:</strong> golang.org/x/crypto/ssh</p> <p>The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a &#34;no-touch-required&#34; extension in Permissions.Extensions from PublicKeyCallback.</p> https://vulnerability.circl.lu/vuln/cve-2026-39831