https://seclists.org/oss-sec/2026/q4/569: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 7, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH=10.6p2
musl musl libc=1.2.5
No. The reported testing used OpenSSH 10.6p2 built with --without-pam, so the observations do not establish behavior for PAM-enabled deployments.
musl returned the string "*" and did not return NULL or set errno in the reported tests. The report says musl treated most invalid settings differently from libxcrypt.
No. In the reported tests, libxcrypt returned "*0" with errno set to EINVAL for malformed settings; passing "*0" then produced "*1", and vice versa. This alternating behavior is intended to prevent the failure result from comparing equal to the setting that generated it.