CVE-2026-39831
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.
Risk Assessment
An attacker can remotely use the security key without physical presence, enabling unauthorized access to systems protected by that key.
Recommendation
Update OpenSSH to a patched version. If not possible, add a 'no-touch-required' extension in Permissions.Extensions from PublicKeyCallback to restore previous behavior.
Original NVD description (English source)
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.