CVE-2026-93994
Received Received - Intake

Authentication Bypass in Apache MINA SSHD via Repeated Public Key

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Apache Software Foundation

Description
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-93994
EUVD
EUVD-2026-89758

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
apache minasshd to 2.20.0 (exc)
apache minasshd From 3.0.0 (inc) to 3.0.0-M6 (exc)
apache minasshd From 3.0.0-M1 (inc) to 3.0.0-M6 (exc)
apache minasshd From 3.0.0-M2 (inc) to 3.0.0-M6 (exc)
apache minasshd From 3.0.0-M3 (inc) to 3.0.0-M6 (exc)
apache minasshd From 3.0.0-M4 (inc) to 3.0.0-M6 (exc)
apache minasshd From 3.0.0-M5 (inc) to 3.0.0-M6 (exc)
apache minasshd 2.20.0
apache minasshd 3.0.0-M6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache MINA SSHD is a Java library for SSH client and server functionality. This vulnerability allows an attacker to bypass multi-authentication requirements by presenting the same public key twice instead of two different keys. The server fails to enforce that the two keys must be distinct, enabling partial authentication bypass.

Detection Guidance

To detect this vulnerability, check the version of Apache MINA SSHD running on your system. If it is version 2.19.0 or earlier, or 3.0.0-M1 to 3.0.0-M5, it is vulnerable. Use commands like 'ssh -V' for client versions or inspect server logs for 'sshd-core' component details.

Impact Analysis

If you use Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 with multi-authentication enabled, an attacker could authenticate with only one key by submitting it twice. This reduces security by bypassing intended multi-factor authentication requirements.

Compliance Impact

This vulnerability could potentially impact compliance with standards requiring strong authentication, such as GDPR's security principle (Article 32) or HIPAA's access control requirements. By allowing partial authentication bypass, it weakens multi-factor authentication mechanisms, which are often mandated for protecting sensitive data.

Mitigation Strategies
  • Upgrade Apache MINA SSHD to version 2.20.0 or 3.0.0-M6 or later to fix the issue.
  • Review server configurations to ensure multi-authentication schemes are properly enforced.
  • Audit authentication logs for suspicious login attempts using the same key twice.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart