CVE-2026-83540
Wolfssh: authentication bypass
- Risk score
- 59/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid acco…
- Affected
- Wolfssh
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Wolfssh: Amber, patch this week. In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbou…
The flaws
- CVE-2026-83540: Authentication bypass (CVSS 8.8 · EPSS 0%)
- CVE-2026-81535: Missing authorisation (CVSS 9.1 · EPSS 0%)
- CVE-2026-83742: Stack buffer overflow can lead to denial of service (CVSS 8.8 · EPSS 0%)
- CVE-2026-16516: WolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches… (CVSS 7.4 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Wolfssh
Where it stands
- No known exploitation
Connects to
- Same weakness: Authentication bypass (CWE-287). 238 other warnings in 30 days
- Same product: Earlier Wolfssh warnings. 1 in the last 90 days
Why it is Yellow
- CVSS 8.8 high
References
Original description
When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.
Last activity 7 Oct 2026. Patch Forecast updates every hour.