Every CVE Search/ Get API key

CVE-2026-93994

Apache MINA SSHD: Repeated-publickey policy bypass on server

8.1 HighFix available

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.30%Down 0.2 points since Sep 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
CVE-2026-93994
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-304
Updated
2026-11-02
EUVDEUVD-2026-89758 8.1

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
EUVD-2026-89758
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-qc4p-9828-mv83 8.1

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be...

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
GHSA-qc4p-9828-mv83
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-304
Updated
2026-11-02
NVD 8.1

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
CVE-2026-93994
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-304
Updated
2026-11-02
OSVDEBIAN-CVE-2026-93994 8.1

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
DEBIAN-CVE-2026-93994
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:71541 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:71541
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-93994 8.1

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Record
UBUNTU-CVE-2026-93994
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11940-1 No score

apache-sshd-2.20.0-1.1 on GA media

These are all security issues fixed in the apache-sshd-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11940-1
Updated
2026-11-02
OSVSUSE-SU-2026:4622-1 No score

Security update for apache-sshd

This update for apache-sshd fixes the following issues:

  • CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).
  • CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).
  • CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write file on the server (bsc#1283350).
  • CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).
  • CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).
  • CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).
  • CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).
  • CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).

Changes for apache-sshd:

  • Update to upstream version 2.20.0:
  • GH-656 ChannelPipedInputStream: shrink buffer when emptied
  • GH-906 Fix finding a signature factory for BC ed25519 keys
  • GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
  • Allow asynchronous authentication only for password and keyboard-interactive authentication schemes
  • Fix authentication requiring multiple public keys (server-side)
  • Better argument handling in sshd-git
  • More checks in authentication (server-side)
  • Better SCP command handling
  • SFTP client: simplify response message handling
  • Fix check-file-name/check-file-handle SFTP v6 extension
  • Improve LDAP authentication (sshd-ldap)
  • New Features
  • GH-905 Implement the 'from' and 'expiry-time' options in authorized_keys handling in public key authentication (server side)
Record
SUSE-SU-2026:4622-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmina-sshd-java
Debian:13
 All versions, plus listed versions
2.13.2-22.13.2-3
 None known
libmina-sshd-java
Debian:14
 All versions, plus listed versions
2.13.2-22.13.2-3
 None known
maven3.9
Red Hat:hummingbird:1
 before 0:3.9.16-0.3.hum1
0:3.9.16-0.3.hum1
maven3.9-lib
Red Hat:hummingbird:1
 before 0:3.9.16-0.3.hum1
0:3.9.16-0.3.hum1
apache-sshd
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
apache-sshd
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
apache-sshd
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 8 CVEs
 before 2.20.0-150200.5.19.1
2.20.0-150200.5.19.1
mina
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-11
 None known
mina2
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.7+dfsg-22.0.9-12.0.9-2
 None known
mina
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-111.1.7.dfsg-12
 None known
mina2
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.0.16-2
 None known
mina
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-13
 None known
mina2
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.0.19-2
 None known
mina
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-13
 None known
mina2
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.1.4-22.1.5-12.1.5-1ubuntu0.1~esm1
 None known
mina
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.7.dfsg-131.1.7.dfsg-13ubuntu1
 None known
mina2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.2.1-32.2.1-3ubuntu0.1~esm1
 None known
mina2
Ubuntu:26.10
 All versions, plus listed versions
2.2.1-42.2.1-4ubuntu12.2.9-1
 None known
mina2
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.2.1-42.2.1-4ubuntu0.1~esm1
 None known
apache-sshd
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.20.0-1.1
2.20.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93994 is a high vulnerability (CVSS 8.1) in Apache Software Foundation Mina Sshd, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in maven3.9 0:3.9.16-0.3.hum1.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open