---
id: CVE-2026-93994
title: Apache MINA SSHD is a Java library for client-side and server-side SSH
summary: >-
  Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH
  servers can be configured to require multi-authentication schemes, for
  instance two different public keys, not just one. In OpenSSH, this would be
  done by settin…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-304
  - CWE-303
vendor: Apache Software Foundation
product: 'org.apache.sshd:sshd-core'
affected:
  - 'org.apache.sshd:sshd-core < 2.20.0'
  - 'org.apache.sshd:sshd-core >= 3.0.0-M1 < 3.0.0-M6'
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T16:13:13.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93994'
references:
  - url: 'https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/29/33'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93994.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93994'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543862'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93994'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93994'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71541'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00303
epssPercentile: 0.22892
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-30T14:29:28.530614Z'
ingestedAt: '2026-09-30T10:01:20.473Z'
patched:
  - hardened_images
---

## Overview

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.




In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.






Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:71541** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71541)
- **Red Hat VEX** · Important · affected: OpenShift Developer Tools and Services, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Enterprise Linux 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, … · no fix planned: Red Hat Enterprise Linux 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, OpenShift Developer Tools and Services, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93994.json)