CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Apache MINA SSHD, a Java library used to build SSH clients and servers, contains a logic error in its rarely used server-side 'asynchronous authentication' feature that can skip signature verification or return a wrong result during public-key or hostbased authentication. An unauthenticated attacker with network access to a vulnerable SSH server could potentially complete authentication without a valid key, gaining the account access that key would have provided (high confidentiality and integrity impact, CVSS 9.1). Only applications whose developers explicitly wrote code to use asynchronous authentication are affected; standard deployments of the library that do not invoke this mechanism are not on the vulnerable path. Maintainers of Java products embedding MINA SSHD 2.0.0–2.19.0 or 3.0.0-M1–3.0.0-M5 should audit for that code pattern and upgrade to 2.20.0 or 3.0.0-M6. No public proof-of-concept exists, no exploitation in the wild has been reported, and the CVE is not on CISA's KEV list.