https://seclists.org/oss-sec/2026/q4/571: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 7, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH=10.6p2
musl musl libc
They need to make password-authentication requests for known usernames and measure authentication-request timing across enough probes. The reported signal is the absence of any KDF-related delay for every tested known account.
The test covered accounts locked with *, !, !!, and *LK*, plus a locked yescrypt hash beginning !$y$.... All of these, as well as a nonexistent user, were within 2.2 ms of one another and roughly 3 to 9 ms above the no-authentication floor.
With password authentication enabled, compare repeated authentication-request timings for multiple known usernames, including locked accounts, against a nonexistent-user baseline. In the reported no-live-password setup, no account produced the substantially larger timing associated with live bcrypt or yescrypt password verification.