Listen to this Post
CVE-2026-102825 is a vulnerability in the Russh Rust SSH client and server library that allows an unauthenticated remote client to bypass the configured maximum authentication attempts limit. The flaw resides in the server-side authentication handling path, specifically in the `USERAUTH_REQUEST` dispatch logic. When a client sends an SSH authentication request, the server increments an internal counter (self.common.auth_attempts) but never compares this counter against the configured limit (server::Config.max_auth_attempts). As a result, an attacker with TCP reachability to a Russh-backed SSH service can continue submitting authentication requests on a single connection indefinitely, completely disregarding the deployment’s attempt-limiting policy. This increases the opportunity for online password guessing and places unnecessary load on backend authentication systems. The issue is tracked as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and has a CVSS v3.1 base score of 3.7 (Low). The vulnerability was confirmed present in the default branch `main` at commit 0089c89c94753bebbec12b956c07a1cd38740379, with the crate version at HEAD being 0.62.4. The affected locations include `russh/src/server/mod.rs:91` where the `max_auth_attempts` field is defined, `russh/src/server/mod.rs:121` where the default value of `10` is set, and `russh/src/server/encrypted.rs:98` where the `auth_attempts` counter is incremented without any bound check. The fix is included in version `0.62.6` and later. A reachability trace confirms that the entry point `server::run_stream` at `russh/src/server/mod.rs:1049` leads to `reply(…)` in russh/src/server/session.rs:725, which forwards encrypted packets to `session.server_read_encrypted(…)` at server/mod.rs:1221, eventually routing `USERAUTH_REQUEST` to `enc.server_read_auth_request(…)` at server/encrypted.rs:89. At no point in this runtime flow does the code compare the accumulated authentication attempts against the configured maximum. The vulnerability was discovered through source code auditing and was not executed in a live environment due to the unavailability of Rust tooling. The researcher used gh, git, rg, and direct source inspection to validate the finding.
DailyCVE Form:
Platform: Russh SSH
Version: < 0.62.6
Vulnerability: Auth Attempt Bypass
Severity: Low
date: 2026-09-29
Prediction: 2026-09-29
What Undercode Say:
Analytics:
Show where max_auth_attempts appears
rtk rg -n "max_auth_attempts" .scratch/russh/russh/src/server/mod.rs .scratch/russh/russh/src/server/encrypted.rs .scratch/russh/russh/src/server/session.rs
Show runtime auth-attempt handling
rtk rg -n "auth_attempts == 0|auth_attempts += 1" .scratch/russh/russh/src/server/encrypted.rs
Show production entrypoint-to-auth path references
rtk rg -n "pub async fn run_stream|match reply(|server_read_encrypted(|server_read_auth_request(" .scratch/russh/russh/src/server/mod.rs .scratch/russh/russh/src/server/session.rs .scratch/russh/russh/src/server/encrypted.rs
Exploit: (Educational Purposes!)
An unauthenticated remote client can repeatedly send USERAUTH_REQUEST packets on a single TCP connection to a russh-based SSH server prior to version 0.62.6. The server increments self.common.auth_attempts but never checks it against server::Config.max_auth_attempts, allowing unlimited authentication attempts.
Protection: from this CVE
Update russh to version 0.62.6 or later.
cargo update -p russh --precise 0.62.6
Alternatively, enforce the limit manually in the USERAUTH_REQUEST branch:
if self.common.config.max_auth_attempts > 0
&& self.common.auth_attempts >= self.common.config.max_auth_attempts
{
self.common.disconnect(
Disconnect::NoMoreAuthMethodsAvailable,
"Too many authentication attempts",
"",
)?;
return Ok(());
}
Impact:
An unauthenticated remote attacker with network access to a russh-backed SSH service can bypass the configured maximum authentication attempts limit, enabling unlimited online password guessing attempts on a single connection. This significantly increases the risk of credential compromise and can also lead to resource exhaustion on backend authentication systems due to the sustained workload.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
