https://seclists.org/oss-sec/2026/q4/572: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 7, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH
musl musl libc
The data identifies the relevant combination as OpenSSH with musl libc. It specifically distinguishes musl from libxcrypt: libxcrypt returns alternating failure tokens such as "*0" and "*1", while musl's failure string is "*".
For malformed password-hash settings, libxcrypt returns a non-NULL failure token and sets errno to EINVAL; its tokens are designed not to compare equal to the input that produced them. Musl is described as returning "*" as its failure string, and that fixed value is stated to matter for the bypass.
Yes. The reported test matrix includes values such as "*", "!", "!!", "x", an empty setting, "$x$", "$9$abc", a truncated "$y$" value, and an invalid-cost "$2b$" value; libxcrypt returned a failure token with errno set to EINVAL for each.