CVE-2026-4541 janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification
Attackers can bypass authentication in tinyssh due to improper Ed25519 signature verification, requiring local access and high complexity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4541?
CVE-2026-4541 is a low-severity vulnerability in janmojzis tinyssh, published on 22 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.
Which versions are affected by CVE-2026-4541?
How do I fix CVE-2026-4541?
Upgrade to a fixed version.
Is CVE-2026-4541 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4541 exists.
Sources
Also known as DEBIAN-CVE-2026-4541, GHSA-g37f-4r6m-qg8m, UBUNTU-CVE-2026-4541.