CVE-2026-127090

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-127090

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127090.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-127090

Published

2026-11-13T09:34:15Z

Modified

2026-11-14T07:06:01Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass

Details

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-305"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127090.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "3.0.33"
                        },
                        {
                            "introduced": "3.1.0"
                        },
                        {
                            "fixed": "3.1.7"
                        },
                        {
                            "fixed": "1.8.1"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "3.0.33"
                        },
                        {
                            "introduced": "3.1.x"
                        },
                        {
                            "fixed": "3.1.7"
                        },
                        {
                            "fixed": "1.8.1"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/sshtools/maverick-synergy

Affected ranges

Type

GIT

Repo

https://github.com/sshtools/maverick-synergy

Events

Introduced

Fixed

f7d23182cce985e21048215e96395881295cb0bd

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "f7d23182cce985e21048215e96395881295cb0bd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*

3.0.10

3.0.10-SNAPSHOT

3.0.5

3.0.6

3.0.8

3.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127090.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "41616639187091501562043196036620407988",
                "258779797537323933807661182767213157952",
                "268021255458716997347261245785581848847",
                "255702977653158813453550421420164298250",
                "84781773630092051868791262954440724410",
                "279647628414493101133832365637883264585",
                "68974599685970023542748261508909427967",
                "106141567358871867298300802551158267189",
                "87247406852957839447181150452615445603",
                "175084178436475240736551862341586889224",
                "336199665561457183983532810564799595112",
                "205175741139352009284258286509475152286",
                "89005698352028489161540354415955541416",
                "122700027187216119960755544526539028937",
                "153519838191514565720333228864051945970",
                "140926506209211152576950039838592786368"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127090-0adb7d6c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd",
        "target": {
            "file": "maverick-synergy-integration-tests/src/test/java/com/sshtools/synergy/tests/AuthenticationIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "334815488169172736978425292715679145927",
                "208119661339434485270960422627230558460",
                "170613597226915535224727536904450099268",
                "299182036771413915673619548004050090264",
                "138931675989908724162723433206253433790",
                "268701459612098331090142183871462971752",
                "50842905884917431240335951161367830760",
                "59263462017898455152152729548337983012",
                "214020746778872954971039059384933324735",
                "4229844095046689467983360616547777295",
                "111020497041533417363291505884189009447",
                "121350299235826873227079042793944936834",
                "326866686584108213002708466023422031694",
                "164632135310192973810458794536637844459",
                "310367476031989547621015658996779103805"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127090-5a88c07f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd",
        "target": {
            "file": "maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "200364602200779568905597789514972364890",
            "length": 250
        },
        "id": "CVE-2026-127090-5c97340b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd",
        "target": {
            "file": "maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java",
            "function": "processMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "143750718528786594934002580529973245832",
            "length": 2491
        },
        "id": "CVE-2026-127090-6790d753",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd",
        "target": {
            "file": "maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java",
            "function": "processRequest"
        }
    }
]

vanir_signatures_modified

"2026-11-14T07:06:01Z"