Authentication Bypass in Jadaptive Maverick Synergy Server

Executive Summary

CVE-2026-127090 is an authentication bypass vulnerability in Jadaptive Maverick Synergy and Legacy SSH servers. It allows an attacker with a valid SSH public key for one account to authenticate and then change the username in the same connection to log in as a different user without authorization. The flaw stems from cached key authorization decisions being reused across usernames during a single SSH session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SSH authentication logs for repeated failed attempts or username changes during a single connection. Check for connections where the same public key authenticates multiple different usernames. Use commands like 'grep' on SSH logs to identify suspicious patterns. Ensure your SSH server logs authentication events thoroughly.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive systems or data. Attackers could impersonate legitimate users, escalate privileges, or perform actions on behalf of other accounts. Systems using public key authentication with affected versions are at risk, especially if multiple users share the same SSH server.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to fixed versions: Maverick Synergy Server 3.2.0, 3.1.7, or 3.0.33, and Maverick Legacy Server 1.8.1. Disable public key authentication if not required. Review all SSH deployments for exposure. If unable to upgrade, contact JADAPTIVE Support for mitigation guidance.

Useful 0 Not Useful 0