goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant -b ':pass'. The empty-password variant bypasses that fix. CVE-2026-40884 CVE-2026-40884 GHSA-c29w-qq4m-2gcv, Apr 13 2026 reported the...

CVE-2026-62325

Goshs 2.1.3–2.1.4 SFTP authentication bypass vulnerability arises from sftpserver/sftpserver.go password handler: it only checks Username != "" && Password != "", which allowed unauthenticated access when running with -b 'admin:' -sftp and without -fkf. The issue effectively lets an attacker acce...

MinIO allows an SFTP authentication bypass due to improperly trusted SSH key

Summary A bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. Details On a MinIO server with SFTP access configured and using LDAP as an external identity provider, MinIO supports SSH key based authentication fo...

Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read

This module exploits CVE-2024-5806, an authentication bypass vulnerability in the MOVEit Transfer SFTP service. The following version are affected: MOVEit Transfer 2023.0.x Fixed in 2023.0.11 MOVEit Transfer 2023.1.x Fixed in 2023.1.6 MOVEit Transfer 2024.0.x Fixed in 2024.0.2 The module can...

EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2023-2484)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass...