{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.sshtools/maverick-synergy-server","product":"Maverick Synergy Server","source":"CNA: VulnCheck","vendor":"Jadaptive","versions":[{"lessThan":"3.0.33","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.1.7","status":"affected","version":"3.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Maverick Legacy Server","source":"CNA: VulnCheck","vendor":"Jadaptive","versions":[{"lessThan":"1.8.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-127090","cwes":["CWE-305"],"description":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.","epss":{"date":"2026-11-13","percentile":0.55862,"score":0.00761},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.8,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.7,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":8.8,"severity":"high","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794594356216,"publishedAt":1794562455399,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentication.java#L82-L100"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/AuthenticationProtocolServer.java#L185-L200"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://jadaptive.com/security/advisories/JADAPTIVE-SA-2026-001"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://store.jadaptive.com/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://store.jadaptive.com/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd"}],"revision":"efc47e6572be3686a569eb2859d92739d2360dc139e5333938fd7dff7958c1c7","sources":[{"modifiedAt":1794594356216,"name":"CNA: VulnCheck","retrievedAt":1794597903009,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127090"},{"modifiedAt":1794585249263,"name":"NVD","retrievedAt":1794593947738,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127090"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794597921219,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-127090"}],"ssvc":{"assessedAt":1794594276800,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass","updatedAt":1794597921219}