https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 17:03:51 +0000 https://db.gcve.eu/vuln/cve-2026-93994 <p><strong>Affected:</strong> Apache Software Foundation Apache MINA SSHD</p> <p>Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods &#34;publickey,publickey&#34;. Apache MINA SSHD provides an equivalent configuration mechanism.</p> <p>In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache MINA SSHD</p> <p>Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods &#34;publickey,publickey&#34;. Apache MINA SSHD provides an equivalent configuration mechanism.</p> <p>In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.</p> <p>Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.</p> https://db.gcve.eu/vuln/cve-2026-93994