# Alpine Linux : openssh-server password authentication bypass

Source: [Lobsters](https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) · 2026-11-07 · Community
Page: https://themorning.dev/story/alpine-linux-openssh-server-password-authentication-bypass-64c7f012498c41d1
Kind: security · Impact: high

## In brief

- Alpine Linux published an advisory on 2026-11-05 about an openssh-server password authentication bypass.
- The bypass claims involve OpenSSH and musl libc and were debated on the oss-sec mailing list on 2026-11-07.
- The claims are disputed: a raw measurement log was published, and a libxcrypt edge case was noted where the failure token is "*" if the buffer is only two bytes, with unclear real-world impact.

## Why it matters

If the bypass is confirmed for your setup, password logins on affected OpenSSH systems could be bypassed, so check whether your systems use OpenSSH with password authentication on musl libc.

## What to do

- Read the Alpine Linux advisory and check whether your openssh-server installation is affected

## Timeline

- 2026-11-05: Alpine Linux publishes advisory on openssh-server password authentication bypass
- 2026-11-07: Bypass claims debated on oss-sec and raw measurement log published

## Coverage

- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/573) — Open Source Security, 2026-11-07
- [Re: "sshole": password authentication bypass: OpenSSH + musl libc](https://seclists.org/oss-sec/2026/q4/572) — Open Source Security, 2026-11-07
- [Alpine Linux : openssh-server password authentication bypass](https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) — Lobsters, 2026-11-07

Tags: openssh, musl, authentication, alpine-linux, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev