CVE-2026-127090: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSHMSGUSERAUTHREQUEST with a different username on the same connection to log in as that account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Maverick Synergy Server before 3.0.33, Maverick Synergy Server 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1.
What does an attacker need to exploit this issue?
The attacker needs an SSH public key that is authorized for at least one account on the target server. They authenticate that key for the authorized account, then reuse the same connection to submit a signed SSH user-authentication request for a different username.
Does exploitation require a separate connection for the target account?
No. The bypass occurs when the attacker sends the authentication request for a different username on the same SSH connection after the key authorization decision has been cached.