Damien Miller

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems

OpenSSH version 10.6p2 introduces a mitigation for a critical vulnerability that allows password authentication bypass on Linux systems using musl libc with PAM disabled. The flaw affects configurations where password verification relies directly on the C library rather than PAM, enabling remote attackers to log in without valid credentials if PasswordAuthentication remains enabled. Systems running Alpine Linux containers or distributions such as postmarketOS, Void Linux musl variant, and certain OpenWRT setups with OpenSSH instead of Dropbear are most exposed. Damien Miller explicitly recommends setting PasswordAuthentication=no or disabling SSH entirely on affected hosts until patched. The issue was reported by Özgün Kültekin of Wakefield and stems from behavior outside sshd itself, though the daemon serves as the attack vector. Alpine Linux quickly issued updated packages, while OpenSSH developers cited rapid AI-driven rediscovery of bugs as justification for short disclosure timelines. No public exploit details or CVE identifier have been released yet.