CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.
In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache MINA SSHDto a version that resolves this vulnerability.Fixed in 2.20.0 - Upgrade
Upgrade
Apache MINA SSHDto a version that resolves this vulnerability.Fixed in 3.0.0-M6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Server deployments using the sshd-core component are affected if they require multiple public-key authentication steps, such as a two-key policy. The issue affects versions up to 2.19.0 and versions 3.0.0-M1 through 3.0.0-M5.
What does an attacker need to bypass the policy?
The attacker needs one public key that is accepted for the account or authentication flow. They can satisfy a two-public-key requirement by presenting that same accepted key twice rather than providing two distinct key pairs.
Are ordinary single-public-key SSH configurations affected?
The described bypass applies to configurations that require repeated public-key authentication, specifically multiple public-key steps intended to use different keys. The provided information does not indicate an impact on configurations requiring only one public key.
What is the recommended remediation?
Upgrade Apache MINA SSHD to version 2.20.0 or 3.0.0-M6, which enforce that the public keys used in the repeated-publickey flow are different.