CVE-2026-48859

Summary

Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.

When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.

The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.

This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl.

This issue affects OTP from OTP 29.0 before 29.0.2 corresponding to ssh from 6.0 before 6.0.1.

Affected Software

VendorProductVersion RangeStatus
ErlangOTP6.0 < 6.0.1affected
ErlangOTP29.0 < 29.0.2affected
ErlangOTP032d1bc9491a3975c68faf9bc7776115d6ae3005 < c342092ef4b369bb409d5b71ac8fd83bab74aedfaffected

Weaknesses

  • CWE-208: CWE-208 Observable Timing Discrepancy

Workarounds

Use the pwdfun option instead of user_passwords for password authentication. The pwdfun callback gives full control over timing behavior and is not affected by this vulnerability. Implementations should take care to execute in approximately constant time regardless of username validity. Restrict SSH port access to trusted networks only via firewall rules, reducing the set of potential attackers who can perform timing measurements.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References