Security · High impactFan score 24 · Tier C3 sources

Re: "sshole": password authentication bypass: OpenSSH + musl libc

The Brief · written from 3 sources

Alpine Linux published an advisory on 2026-11-05 about an openssh-server password authentication bypass.
The bypass claims involve OpenSSH and musl libc and were debated on the oss-sec mailing list on 2026-11-07.
The claims are disputed: a raw measurement log was published, and a libxcrypt edge case was noted where the failure token is "*" if the buffer is only two bytes, with unclear real-world impact.

Why it matters

If the bypass is confirmed for your setup, password logins on affected OpenSSH systems could be bypassed, so check whether your systems use OpenSSH with password authentication on musl libc.

Who’s affected

Alpine Linux users running openssh-server
Systems running OpenSSH with password authentication on musl libc

What to do

Read the Alpine Linux advisory and check whether your openssh-server installation is affected

#openssh
#musl
#authentication
#alpine-linux
#vulnerability

Posted by Richard Kettlewell on Nov 07 https://github.com/besser82/libxcrypt/blob/develop/lib/util-make-failure-token.c Pedantically: the result will be "*" if the buffer is only two bytes (L37-42). I don't whether any real-life callers do this. ttfn/rjk

Read the full story at seclists.org ↗