Description

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T16:18:17.607Z",
  "pubdate": "2026-08-28T16:18:17.607Z",
  "executiveSummary": "This vulnerability involves an incomplete security enforcement mechanism within authentication callback logic, specifically concerning source-address restriction policies.\nThe flaw allows authentication methods, including PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin, to bypass validation checks intended to verify the client's remote IP address against configured source-address restrictions.\nBy failing to enforce the 'source-address' critical option for these specific callback types, the system permits authentication attempts from unauthorized network origins that should have been explicitly blocked by the defined security policy.\nThis represents a significant breakdown in access control, as security administrators relying on IP-based gating for these authentication mechanisms are left unprotected.\nAn attacker can exploit this condition by initiating authentication requests from forbidden network segments, effectively neutralizing the intended perimeter security controls.\nThe vulnerability highlights a lack of consistency in policy enforcement across the authentication framework, requiring a comprehensive patch to ensure that all callback returns are subject to the same rigorous validation logic previously reserved only for PublicKeyCallback and VerifiedPublicKeyCallback paths.",
  "technicalDetails": "The vulnerability stems from a logical inconsistency in the enforcement of the 'source-address' critical option within the authentication subsystem. Previously, the system implemented a fix for CVE-2026-46595, which ensured that the Permissions returned by an authentication callback were verified against the client's source IP address.\nHowever, this validation check was scoped exclusively to the PublicKeyCallback and VerifiedPublicKeyCallback execution paths. The implementation failed to extend this security constraint to other critical callback handlers: PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin.\nWhen an authentication callback is triggered, the system retrieves a set of Permissions intended to govern the session. If the configuration defines a source-address restriction, the security framework is expected to intercept these Permissions and validate that the requesting client's network address matches the permitted range.\nIn the vulnerable state, when the authentication process utilizes the aforementioned affected callbacks, the system skips the validation routine for the source-address restriction entirely. Consequently, if a malicious actor or an unauthorized user initiates a request from a blocked source IP, the callback logic proceeds to grant access or continue the authentication flow without checking the restriction policy.\nThe root cause is a deficiency in the abstraction layer where the security policy application logic was not globally registered to all authentication event handlers. Because the enforcement was implemented on a per-method basis rather than a centralized filter, certain code paths were omitted from the security perimeter.\nThe attack flow involves: 1. The attacker determines or guesses that a specific IP-based restriction is configured for an authentication service. 2. The attacker initiates an authentication attempt (Password, Keyboard-Interactive, etc.) from an unauthorized source address. 3. The service triggers the corresponding callback. 4. The callback returns a standard set of Permissions. 5. The security framework, due to the missing check for these specific callback types, fails to validate the source address against the return object. 6. The system honors the authentication attempt, bypassing the intended network-level security control.\nThe impact includes the potential for unauthorized access to services that rely on IP-based segmentation as a primary defensive layer, essentially rendering those restrictions moot for the affected authentication protocols."
}