Executive brief
A vulnerability in the Go SSH library allows attackers to bypass the physical touch requirement on FIDO/U2F hardware security keys. This means a hardware key could be used to sign in or authorize actions without the owner actually pressing the button on the device. This flaw could lead to unauthorized access to systems or data even when hardware-based multi-factor authentication is enforced.
Technical details
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com) in golang.org/x/crypto/ssh failed to validate the User Presence (UP) flag in the authenticator data. This allows an attacker or malicious software to utilize a connected hardware security key for SSH authentication without the required physical interaction from the user. The vulnerability is reachable over the network if the library is used in an SSH server or client context. The issue is fixed in version 0.52.0, which restores the check; developers can manually allow touchless operation by returning a 'no-touch-required' extension in Permissions.Extensions.
Affected products
- Go golang.org/x/crypto/ssh < 0.52.0
Timeline
- 2026-05-22: disclosed: NVD and Go project initial publication
- 2026-06-25: advisory: GitHub Advisory published
- 2026-06-25: patched: Version 0.52.0 released