{"id":"CVE-2026-83540","title":"When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in …","summary":"When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-287","CWE-613"],"vendor":"wolfssh","product":"wolfssh","affected":["wolfssh >= 1.4.15, < 1.6.0"],"patched":["wolfssh 1.6.0"],"published":"2026-10-07","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:33:17.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83540","references":[{"url":"https://github.com/wolfSSL/wolfssh","label":"facts@wolfssl.com"},{"url":"https://github.com/wolfSSL/wolfssh/commit/9777bc5ce810d6c418a1473e9e8c40cdb0026e5a","label":"facts@wolfssl.com"},{"url":"https://github.com/wolfSSL/wolfssh/commit/b6bd975ccfac6aadf29b98e35e09114bef3840a9","label":"facts@wolfssl.com"},{"url":"https://www.wolfssl.com/docs/security-vulnerabilities/","label":"facts@wolfssl.com"}],"tags":["nvd","cve.org"],"epss":0.00552,"epssPercentile":0.45958,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-07T11:28:54.655733Z"},"scores":{"nvd":8.8,"cna":7.7},"ingestedAt":"2026-10-07T03:28:55.182Z","slug":"CVE-2026-83540","body":"## Overview\n\nWhen password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.\n\n## Affected\n\n- `wolfssh >= 1.4.15, < 1.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wolfssh 1.6.0`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":219814,"id":"CVE-2026-83540","ts":1791913173069,"field":"cvss","old":"7.7","new":"8.8"}]}