CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server
Apache MINA SSHD can bypass a repeated-publickey multi-authentication requirement, CVE-2026-93994, CVSS 8.1.
Apache MINA SSHD servers configured to require multiple distinct public keys can have that repeated-publickey policy bypassed. CVE-2026-93994 is rated important, with CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Affected builds are those before 2.20.0 and milestones 3.0.0-M1 through 3.0.0-M5. The disclosure does not say the bypass is being exploited.
- CVE-2026-93994 bypasses a repeated-publickey multi-authentication server policy.
- CVSS 3.1 is 8.1, with high confidentiality and integrity impact.
- Apache rates it important; low privileges and network access are required.
- Fixed lines are 2.20.0 and 3.0.0-M6; exploitation is not reported.
Vulnerabilities mentionedAll →
- CVE-2026-939948.1—Repeated public-key auth bypass in Apache MINA SSHDpublished · Apache MINA SSHD
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-93994 | Repeated public-key auth bypass in Apache MINA SSHD Apache MINA SSHD is a Java library for SSH clients and servers. Its server component (sshd-core) can require multiple authentication methods, including two different public keys, but in versions through 2.19.0 and 3.0.0-M1 through 3.0.0-M5 it does not check that the two keys presented are distinct. A user who already holds one accepted key pair can satisfy a two-public-key policy by presenting that same key twice, which is a partial authentication bypass rather than access with no credentials. Only deployments that run MINA SSHD as a server with a multi-public-key requirement are affected. No public proof-of-concept is known, and the issue is not listed in CISA KEV. Do: Upgrade Apache MINA SSHD (sshd-core) to 2.20.0 or 3.0.0-M6. Until then, do not treat a two-public-key policy as a second factor: require a different second method (for example public key plus password or keyboard-interactive) and review servers for multi-public-key authentication settings. |
Posted by Thomas Wolf on Sep 29 Severity: important CVSS 3.1: 8.1 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in...
This source does not provide full text. Read it at seclists.org.