AIKIDO-2026-651819
asyncssh is vulnerable to Race Condition (TOCTOU)
64
Medium Risk
This Affects:
asyncsshTL;DR
_process_userauth_request() in asyncssh/connection.py passes each SSH_MSG_USERAUTH_REQUEST to _finish_userauth() through a detached create_task() call, so a new request can run before the previous one finishes. A new request sets _username while the earlier attempt is still running, and that earlier attempt can still report success, so the server records the wrong username as the authenticated user. The fix cancels the previous attempt and accepts success only from the attempt that is still active.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
asyncssh is vulnerable to Race Condition (TOCTOU) in versions 1.12.0 - 2.24.0.
How to fix this
Upgrade the asyncssh library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.