Cyber ·
Possible password authentication bypass in OpenSSH with musl libc
A discussion on the oss-sec list raises the possibility that crypt, on error, returns “*” as a valid hash, which could allow improper password login on systems using musl libc. The text does not confirm the problem.
According to the text published on November 5, 2026 on the oss-sec list, Debian's crypt(3) manual page says that on error the functions crypt, crypt_r, crypt_rn and crypt_ra write an invalid hash. That hash would be shorter than 13 characters, start with “*” and not equal the comparison value. Based on this, a list participant argues that “*” could be a valid result on error, raising the possibility of a password authentication bypass in OpenSSH when combined with musl libc. The author himself says the point is unclear. The text provides no exploit proof, affected versions, fix or official project advisory. To verify, consult the original oss-sec discussion and the documentation of the system in use, and confirm with the OpenSSH and musl maintainers before drawing any conclusion.
Original source: Re: “sshole”: desvio da autenticação por senha no OpenSSH + musl libc