#Alpine

Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2)

Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. No CVE had been assigned when the advisory was published.

OpenSSH sshd on Alpine Linux (openssh-server, built without PAM)·Since Nov 5, 2026·updated Nov 5, 2026, 15:01 UTC