CVE-2026-59851 — Libssh: libssh: authentication bypass via missing gssapi principal check
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the r…
Published: 2026-07-21 · CVSS: 8.8 · CVSS 3.1
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7