Executive brief
AsyncSSH is a Python library used to build SSH clients and servers. A security flaw allows attackers to bypass authentication by providing a specially crafted username containing path traversal characters (like "../"). If the server is configured to look up user keys using the %u placeholder, an attacker can trick the system into reading a different file they control, allowing them to log in without a valid password or authorized key.
Technical details
A path traversal vulnerability exists in AsyncSSH's handling of the %u token within the AuthorizedKeysFile configuration. When the server reloads configuration or processes public-key authentication, it expands the %u placeholder using the raw, unvalidated SSH username provided by the client. By supplying a username containing path traversal segments (e.g., ../, \, or /), an attacker can force the server to read an authorized-keys file from an unintended location on the filesystem. If the attacker can place or reference a file in a known location that contains their own public key, they can successfully authenticate as the traversal username. This issue is fixed in version 2.23.0 by implementing strict validation for username substitutions.
Affected products
- ronf AsyncSSH < 2.23.0
Timeline
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD
- 2026-07-17: patched: Fix released in version 2.23.0