{"affected":[{"ranges":[{"events":[{"introduced":"032d1bc9491a3975c68faf9bc7776115d6ae3005"},{"fixed":"c342092ef4b369bb409d5b71ac8fd83bab74aedf"}],"repo":"https://github.com/erlang/otp","type":"GIT"}]}],"aliases":["GHSA-3w6p-vwhf-wvp4","CVE-2026-48859"],"credits":[{"name":"Zhang Delong","type":"FINDER"},{"name":"Jakub Witczak","type":"REMEDIATION_DEVELOPER"},{"name":"Ingela Anderton Andin","type":"REMEDIATION_REVIEWER"},{"name":"Michał Wąsowski","type":"REMEDIATION_REVIEWER"}],"database_specific":{"capec_ids":["CAPEC-116"],"cpe_ids":["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-208"]},"details":"## Summary\n\nObservable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh\\_auth, ssh\\_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.\n\nWhen the SSH daemon is configured with the user\\_passwords or password option, ssh\\_auth:check\\_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh\\_options:get\\_password\\_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.\n\nThe user\\_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh\\_auth.erl and lib/ssh/src/ssh\\_options.erl.\n\nThis issue affects OTP from OTP 29.0 before 29.0.2 corresponding to ssh from 6.0 before 6.0.1.\n\n## Workaround\n\nUse the pwdfun option instead of user\\_passwords for password authentication. The pwdfun callback gives full control over timing behavior and is not affected by this vulnerability. Implementations should take care to execute in approximately constant time regardless of username validity.\n\nRestrict SSH port access to trusted networks only via firewall rules, reducing the set of potential attackers who can perform timing measurements.\n\n## Configuration\n\nThe SSH daemon must be configured with the user\\_passwords or password option for password authentication. Systems using the pwdfun option instead are not affected.","id":"EEF-CVE-2026-48859","modified":"2026-06-10T14:38:17.058Z","published":"2026-06-10T14:35:43.553Z","references":[{"type":"ADVISORY","url":"https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-48859.html"},{"type":"WEB","url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"type":"FIX","url":"https://github.com/erlang/otp/commit/c342092ef4b369bb409d5b71ac8fd83bab74aedf"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","type":"CVSS_V4"}],"summary":"SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration","upstream":[]}