CVE-2026-127090

EUVD-2026-125093
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 55.86%
Common Weakness Enumeration
References
https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100
https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200
https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd
https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001
https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985
https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4
https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass