CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

High 8.1 Published 30 Sep 2026 Updated 30 Sep 2026

Attackers can bypass multi-factor public key authentication by presenting the same key twice in Apache MINA SSHD servers configured for repeated public key checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-93994?

CVE-2026-93994 is a high-severity authentication bypass vulnerability in Apache MINA SSHD, published on 30 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.

Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Weakness: CWE-304

Which versions are affected by CVE-2026-93994?

Linux distribution packages (2)

`maven3.9` Red Hat:hummingbird:1	All versions	`0:3.9.16-0.3.hum1`
`maven3.9-lib` Red Hat:hummingbird:1	All versions	`0:3.9.16-0.3.hum1`

How do I fix CVE-2026-93994?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-93994 being exploited?

There is no known exploitation of CVE-2026-93994 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-93994, GHSA-qc4p-9828-mv83, RHSA-2026:71541, UBUNTU-CVE-2026-93994.