CVE-2026-39831
Published: May 22, 2026· Updated: May 22, 2026
Official Description
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Risk Analysis
This critical vulnerability, with a CVSS score of 9.1, affects FIDO/U2F security key types in OpenSSH. It allows signatures to be accepted even if the user presence (physical touch) flag is not checked, enabling unattended use of hardware security keys. This bypass undermines a core security feature of these keys.
There is no public exploit known for this remotely exploitable vulnerability. The low attack complexity indicates that an exploit, once developed, could be straightforward to use.
To mitigate this, ensure that the PublicKeyCallback explicitly returns a "no-touch-required" extension in Permissions.Extensions to restore the expected behavior. Review and update OpenSSH configurations to enforce user presence checks for FIDO/U2F keys.
Technical Analysis
CVE-2026-39831 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (4)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-39831 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts