Description
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.
In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.
Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache MINA SSHD | < 2.20.0, 3.0.0-M1 – < 3.0.0-M6 | 2.20.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmina-sshd-java | 2.20.1-1 | — |
| Debian 13 | libmina-sshd-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | mina2 | No fix yet | — |
| Ubuntu 24.04 LTS | mina | No fix yet | — |
| Ubuntu 20.04 LTS | mina2 | No fix yet | — |
| Ubuntu 18.04 LTS | mina2 | No fix yet | — |
| Ubuntu 16.04 LTS | mina2 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | mina2 | No fix yet | — |
| Ubuntu Pro 24.04 LTS | mina2 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | mina2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-sshd | 2.20.0-1.redhat_00002.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.86.0-1.redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.9.1-1.GA_redhat_00002.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-ironjacamar +8 | 3.1.1-1.Final_redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-jackson-jaxrs-base +7 | 2.18.11-1.redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-mod_cluster | 2.1.1-1.Final_redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-neethi | 3.2.4-1.redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.9.1-1.GA_redhat_00006.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-wildfly-http-client +4 | 2.1.5-1.Final_redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-15.GA_redhat_00052.1.el8eap | RHSA-2026:99018 |
| Red Hat JBoss EAP 8 | eap8-ws-commons-XmlSchema | 2.3.3-1.redhat_00001.1.el8eap | RHSA-2026:99018 |
| Red Hat Hardened Images 1 | maven3.9 +1 | 3.9.16-0.3.hum1 | RHSA-2026:71541 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLES 15 SP6 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLES 15 SP5 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLES 15 SP4 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLES for SAP 15 SP5 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLES for SAP 15 SP4 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLE HPC 15 SP5 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
| SLE HPC 15 SP4 | apache-sshd | 2.20.0-150200.5.19.1 | SUSE-SU-2026:4622-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-sshd | 2.20.0-1.1 | openSUSE-SU-2026:11940-1 |
Advisories 5
- RHSA-2026:71541 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99018 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- SUSE-SU-2026:4622-1 Security update for apache-sshd SUSE / openSUSE Security Updates · Oct 13, 2026
- openSUSE-SU-2026:11940-1 apache-sshd-2.20.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 2, 2026