Summary

On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters. The post OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass appeared first on SecurityWeek .

For more information, read the full story at the original source: SecurityWeek ↗

Vulnerabilities in this story

• CVE-2026-123158 KEV · fix by 2026-11-12 OpenBSD OpenSSH EPSS 1% 8.1High

Also reported by

• BleepingComputer: Hackers exploit SSHole OpenSSH flaw to breach Linux systems ↗
• ZDNet How-to: Alpine Linux and OpenSSH patch flaw that’s as bad as it can get ↗
• The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot ↗
• Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) ↗