{"id":"CVE-2026-127090","summary":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass","details":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.","modified":"2026-11-14T07:06:01.669242460Z","published":"2026-11-13T09:34:15.399Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127090.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"fixed":"3.0.33"},{"introduced":"3.1.0"},{"fixed":"3.1.7"},{"fixed":"1.8.1"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"range":[{"fixed":"3.0.33"},{"introduced":"3.1.x"},{"fixed":"3.1.7"},{"fixed":"1.8.1"}],"source":"DESCRIPTION"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-305"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127090.json"},{"type":"PACKAGE","url":"https://github.com/sshtools/maverick-synergy"},{"type":"ARTICLE","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"},{"type":"ARTICLE","url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"},{"type":"FIX","url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"type":"ADVISORY","url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127090"},{"type":"ADVISORY","url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"type":"ADVISORY","url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sshtools/maverick-synergy","events":[{"introduced":"0"},{"fixed":"f7d23182cce985e21048215e96395881295cb0bd"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"f7d23182cce985e21048215e96395881295cb0bd"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["3.0.10-SNAPSHOT","3.0.10","3.0.9","3.0.8","3.0.6","3.0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127090.json","vanir_signatures":[{"target":{"file":"maverick-synergy-integration-tests/src/test/java/com/sshtools/synergy/tests/AuthenticationIT.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["41616639187091501562043196036620407988","258779797537323933807661182767213157952","268021255458716997347261245785581848847","255702977653158813453550421420164298250","84781773630092051868791262954440724410","279647628414493101133832365637883264585","68974599685970023542748261508909427967","106141567358871867298300802551158267189","87247406852957839447181150452615445603","175084178436475240736551862341586889224","336199665561457183983532810564799595112","205175741139352009284258286509475152286","89005698352028489161540354415955541416","122700027187216119960755544526539028937","153519838191514565720333228864051945970","140926506209211152576950039838592786368"]},"id":"CVE-2026-127090-0adb7d6c","signature_type":"Line","signature_version":"v1","source":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd","target":{"file":"maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["334815488169172736978425292715679145927","208119661339434485270960422627230558460","170613597226915535224727536904450099268","299182036771413915673619548004050090264","138931675989908724162723433206253433790","268701459612098331090142183871462971752","50842905884917431240335951161367830760","59263462017898455152152729548337983012","214020746778872954971039059384933324735","4229844095046689467983360616547777295","111020497041533417363291505884189009447","121350299235826873227079042793944936834","326866686584108213002708466023422031694","164632135310192973810458794536637844459","310367476031989547621015658996779103805"]},"id":"CVE-2026-127090-5a88c07f"},{"target":{"file":"maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java","function":"processMessage"},"deprecated":false,"digest":{"function_hash":"200364602200779568905597789514972364890","length":250},"id":"CVE-2026-127090-5c97340b","signature_type":"Function","signature_version":"v1","source":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"source":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd","target":{"function":"processRequest","file":"maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java"},"deprecated":false,"digest":{"function_hash":"143750718528786594934002580529973245832","length":2491},"id":"CVE-2026-127090-6790d753","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-11-14T07:06:01Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}