CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-83540

The wolfSSHd Windows port is vulnerable to a race condition in versions 1.4.15 through 1.5.0 . When using password or public key authentication, the Windows logon token from one authenticated connection is not released before being reused for a subsequent connection. This flaw can lead to user lo...