Listen to this Post
The authentication bypass vulnerability in Soft Serve (versions <=0.11.2) exploits a flaw in the SSH handshake process. Soft Serve, a Git server, uses SSH for client authentication. During the SSH key exchange, clients can offer multiple public keys for authentication. In affected versions, when a client offers a public key, the server immediately associates the user identity from that key with the session context, even if that specific authentication attempt fails. This user identity is stored in the session and not cleared upon subsequent authentication steps. An attacker can leverage this by first offering the victim’s public key during the handshake, which sets the session identity to the victim. Then, the attacker authenticates with their own valid private key. Since the session context retains the victim’s identity from the initial offer, the server incorrectly grants the attacker access as the victim. This allows impersonation of any registered user, including administrators, without possessing their private keys. The vulnerability stems from improper session state management, where the user identity from an offered key persists despite authentication failure, bypassing authentication controls.
Platform: Soft Serve
Version: <=0.11.2
Vulnerability: Authentication Bypass
Severity: High
date: Jan21,2026
Prediction: Patch released Jan21,2026
What Undercode Say:
Showing bash commands and codes related to the blog
ssh -o “PubkeyAuthentication yes” -i victim_pubkey -i attacker_key user@server
Flawed session code snippet:
session.context.user = offeredKey.user; // Not cleared on auth failure
how Exploit:
Offer victim public key. Authenticate with attacker key. Session impersonates victim.
Protection from this CVE:
Upgrade to version 0.11.3.
Impact:
Unauthorized admin access. Full user impersonation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
