Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
Summary
| CVE | CVE-2026-127090 |
|---|---|
| State | PUBLISHED |
| Assigner | VulnCheck |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 10:18:05 UTC |
| Updated | 2026-11-13 19:19:28 UTC |
| Description | Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-305 | CWE-305 Authentication Bypass by Primary Weakness
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Jadaptive | Maverick Synergy Server | affected 3.0.33 semver | Not specified |
| CNA | Jadaptive | Maverick Synergy Server | affected 3.1.0 3.1.7 semver | Not specified |
| CNA | Jadaptive | Maverick Legacy Server | affected 1.8.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/... | [email protected] | github.com | |
| www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-an... | [email protected] | www.vulncheck.com | |
| jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001 | [email protected] | jadaptive.com | |
| store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985 | [email protected] | store.jadaptive.com | |
| store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4 | [email protected] | store.jadaptive.com | |
| github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/j... | [email protected] | github.com | |
| github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e9639... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jadaptive Limited (en)
There are currently no legacy QID mappings associated with this CVE.