# Critical Flaw in OpenSSH Allows Authentication Bypass on Some Linux Servers

*Published November 6, 2026*
*Source: [https://cybersecuritynews.com/openssh-flaw-bypass-password-authentication/](https://cybersecuritynews.com/openssh-flaw-bypass-password-authentication/)*

## Executive Summary

A critical OpenSSH vulnerability allows attackers to bypass password authentication on some Alpine Linux servers using musl libc without PAM. Immediate patching and configuration adjustments are required to mitigate the risk and secure affected systems.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/critical-flaw-in-openssh-allows-authentication-bypass-on-some-linux-servers) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A significant vulnerability in OpenSSH has been identified, allowing remote attackers to bypass password authentication on some Alpine Linux servers. This issue affects systems utilizing musl libc without the Pluggable Authentication Module, or PAM. OpenSSH released version 10.6p2 on November 5, 2026, to address this flaw. The vulnerability was discovered by Özgün Kültekin from Wakefield, who detailed the exploit on sshhole.com. The exploit involves using an extraordinarily long password to manipulate a failed password check into a successful login, affecting accounts on Alpine Linux that were intended for key-only access. For remote exploitation, attackers need a reachable SSH port and a known account name. The flaw is triggered when an account's password field contains an asterisk, while another local account includes a dollar-sign-prefixed password hash. Systems that use the standard openssh-server package without PAM are vulnerable, whereas those with PAM enabled are not.

This vulnerability arises from an interaction between OpenSSH and the musl libc crypt() function. When a password exceeding 256 bytes is submitted, it causes musl's password-hashing code to return an asterisk as an error marker. This matches the stored password field in the affected account, allowing unauthorized access. Alpine advises immediate upgrades using the apk upgrade command followed by an SSH service restart. Fixed releases include versions 3.21.10 through 3.24.4, with patches for earlier versions also available. As a temporary measure, administrators can disable password authentication and ensure key-based access is functioning.

Alpine Linux's advisory highlights the importance of treating systems as potentially compromised if unauthorized access is suspected. Administrators are urged to review logs for unexpected password-based access and inspect for unauthorized access activities. This flaw emphasizes the critical need for regular updates and careful configuration management to protect against evolving threats.