Cyber ·
Discussion on oss-sec about a password authentication bypass in OpenSSH with musl libc
A reply on the oss-sec list points to a case where a failure token function returns “*” when the buffer has only two bytes, and asks whether this happens in practice.
A thread on the oss-sec mailing list, published on November 7, 2026 under the title “sshole”, discusses a possible password authentication bypass in OpenSSH combined with musl libc. The archived item is a reply that points, in libxcrypt code, to the failure token generation file, lines 37 to 42. According to the text, if the buffer has only two bytes, the result will be “*”.
The reply author says they do not know whether any real caller uses this configuration and leaves the question open. The available text does not confirm exploitation, affected versions or a fix. For those, check the original thread on the oss-sec list and the advisories of the projects involved. Rota Nacional does not solve this engineering problem and does not verify this code. If your team uses AI to study the advisory, remove real host names, users, keys and configurations before pasting any excerpt, because automatic detection covers CPF, CNPJ, e-mail, phone and person names, but not credentials or server names.
Original source: Re: “sshole”: bypass de autenticação por senha em OpenSSH + musl libc