HIGHCVSS v3.1 8.8Vulnerability
CVE-2026-127090
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00761
- Cvss severity
- HIGH
- Cvss score
- 8.8
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 8.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-127090
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-13T10:18:05.620
- Last modified
- 2026-11-13T19:19:28.777
- Epss percentile
- 0.55862
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph