Critical · 9.4 CVE-2025-11625 EUVD-2025-35174GHSA-mhjf-4hv6-xqgr

Host verification bypass and credential leak

Published Oct 21, 2025 · Updated Jan 6, 2026 · Assigned by wolfSSL

Description

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.

Affected products

Vendor	Product	Affected	Fixed
wolfSSL	wolfSSH	1.4.20;0	—

References

https://github.com/wolfSSL/wolfssh/pull/840