AIKIDO-2026-10064
wolfSSL.wolfssh is vulnerable to Improper Authentication
94
Critical Risk
This Affects:
wolfSSL.wolfsshTL;DR
WolfSSH’s key exchange state machine can be manipulated, allowing an attacker to leak the client’s password in clear text, coerce the client into generating a bogus signature, or bypass user authentication entirely. Users of wolfSSH are advised to update to a fixed version or apply the provided patch. As a precaution, it is also recommended to rotate any credentials that may have been exposed. The fix should likewise be applied to wolfSSH server applications: although no specific server-side attacks are currently known, the same underlying defect is present.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
wolfSSL.wolfssh is vulnerable to Improper Authentication in versions 0.0.1 - 1.4.21.
How to fix this
Upgrade the wolfSSL.wolfssh library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.