AIKIDO-2026-10064
wolfSSL.wolfssh is vulnerable to Improper Authentication
94
Critical Risk
This Affects:
wolfSSL.wolfsshTL;DR
WolfSSH’s key exchange state machine can be manipulated, allowing an attacker to leak the client’s password in clear text, coerce the client into generating a bogus signature, or bypass user authentication entirely. Users of wolfSSH are advised to update to a fixed version or apply the provided patch. As a precaution, it is also recommended to rotate any credentials that may have been exposed. The fix should likewise be applied to wolfSSH server applications: although no specific server-side attacks are currently known, the same underlying defect is present.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
wolfSSL.wolfssh is vulnerable to Improper Authentication in versions 0.0.1 - 1.4.21.
How to fix this
Upgrade the wolfSSL.wolfssh library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant