Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2) · updates https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026 Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. No CVE had been assigned when the advisory was published. en Thu, 05 Nov 2026 00:00:00 GMT Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2): OpenSSH releases portable 10.6p2 with a fix that avoids a password authentication bypass in sshd affecting some Linux systems built and run without PAM, reported by Özgün Kültekin of Wakefield. https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026 https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026#2026-11-05-41dd99ef Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://www.openssh.org/releasenotes.html">Source</a></p> Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2): Alpine Linux publishes its advisory and fixed openssh packages for 3.16 through 3.24 and edge, and says to restart sshd after upgrading or set PasswordAuthentication no. https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026 https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026#2026-11-05-018c7235 Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/">Source</a></p>