Description
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jadaptive | Maverick Synergy Server | < 3.0.33, 3.1.0 – < 3.1.7 | 3.0.33 |
| Jadaptive | Maverick Legacy Server | < 1.8.1 | 1.8.1 |
References
- https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001 vendor-advisory
- https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd patch
- Maverick Synergy Release Notes release-notes
- Maverick Legacy Server Release Notes release-notes
- https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100 technical-description
- https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200 technical-description
- VulnCheck Advisory: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass third-party-advisory