{"id":"CVE-2026-127090","kind":"vulnerability","aliases":["CVE-2026-127090"],"related":[],"title":"Maverick Synergy SSH server: key auth lets attackers log in as other users","description":"Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.","summary":"Maverick Synergy and Maverick Legacy SSH servers cache public key authorization decisions across usernames on a connection. An attacker holding a key authorized for one account can log in as a different account on the same connection.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","java","maverick-legacy","maverick-synergy","ssh"],"not_affected_if":["no-ssh-exposure","password-only-auth"],"how_to_check":"- Check the installed Maverick Synergy Server version and confirm it is at or above `3.0.33` or `3.1.7`\n- Check the installed Maverick Legacy Server version and confirm it is at or above `1.8.1`","fix":"- Maverick Synergy Server: move to `3.0.33` (for the 3.0 line) or `3.1.7` (for the 3.1 line)\n- Maverick Legacy Server: move to `1.8.1`","status":"open","published_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:48:45+00:00","updated_at":"2026-11-13T10:48:45+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T10:48:45Z","model":"claude-haiku-5-5","output":{"fix":"- Maverick Synergy Server: move to `3.0.33` (for the 3.0 line) or `3.1.7` (for the 3.1 line)\n- Maverick Legacy Server: move to `1.8.1`","reach":"network","title":"Maverick Synergy SSH server: key auth lets attackers log in as other users","impact":"high","summary":"Maverick Synergy and Maverick Legacy SSH servers cache public key authorization decisions across usernames on a connection. An attacker holding a key authorized for one account can log in as a different account on the same connection.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ssh","maverick-synergy","maverick-legacy","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as another account on the SSH server","analyst_note":"product_name not given in input; exact affected product list rests on NVD text.","how_to_check":"- Check the installed Maverick Synergy Server version and confirm it is at or above `3.0.33` or `3.1.7`\n- Check the installed Maverick Legacy Server version and confirm it is at or above `1.8.1`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-ssh-exposure","password-only-auth"],"who_is_affected":"Servers running Jadaptive Maverick Synergy Server or Maverick Legacy Server that accept SSH public key logins are exposed. An attacker needs a valid key for one account on the server, so systems without SSH key authentication or with only password or no SSH access can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4669,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127090':16A,19A '-2026':15A,18A '1.8.1':82C '3.0.33':71C '3.1':73C '3.1.7':76C 'account':54B,61B,108C,133C 'across':41B,99C 'attack':8A,47B,101C 'auth':6A 'authent':85C,92C,110C 'author':39B,51B,97C,105C 'bypass':86C 'cach':36B,95C 'connect':45B,65B,127C 'contain':83C 'cve':14A,17A 'decis':40B,98C 'differ':60B,122C 'hold':48B,102C 'infrastructur':20B 'jadapt':66C 'java':21B 'key':5A,38B,50B,91C,96C,104C 'legaci':24B,33B,79C 'let':7A 'log':9A,56B,129C 'maverick':1A,23B,26B,29B,32B,67C,78C 'maverick-legaci':22B 'maverick-synergi':25B 'msg':117C 'one':53B,107C 'public':37B,90C 'request':119C 'reus':94C 'send':113C 'server':4A,35B,69C,80C 'sign':115C 'ssh':3A,28B,34B,89C,116C 'synergi':2A,27B,30B,68C 'user':13A 'userauth':118C 'usernam':42B,100C,123C 'vulner':87C 'x':74C","nicknames":[],"mitigations":[],"who_affected":"Servers running Jadaptive Maverick Synergy Server or Maverick Legacy Server that accept SSH public key logins are exposed. An attacker needs a valid key for one account on the server, so systems without SSH key authentication or with only password or no SSH access can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","java","mavericklegacy","mavericksynergy","ssh"],"campaign_type":null,"search_a":"'-127090':16A,19A '-2026':15A,18A 'attack':8A 'auth':6A 'cve':14A,17A 'key':5A 'let':7A 'log':9A 'maverick':1A 'server':4A 'ssh':3A 'synergi':2A 'user':13A","search_b":"'account':54B,61B 'across':41B 'attack':47B 'author':39B,51B 'cach':36B 'connect':45B,65B 'decis':40B 'differ':60B 'hold':48B 'infrastructur':20B 'java':21B 'key':38B,50B 'legaci':24B,33B 'log':56B 'maverick':23B,26B,29B,32B 'maverick-legaci':22B 'maverick-synergi':25B 'one':53B 'public':37B 'server':35B 'ssh':28B,34B 'synergi':27B,30B 'usernam':42B","search_c":"'1.8.1':82C '3.0.33':71C '3.1':73C '3.1.7':76C 'account':108C,133C 'across':99C 'attack':101C 'authent':85C,92C,110C 'author':97C,105C 'bypass':86C 'cach':95C 'connect':127C 'contain':83C 'decis':98C 'differ':122C 'hold':102C 'jadapt':66C 'key':91C,96C,104C 'legaci':79C 'log':129C 'maverick':67C,78C 'msg':117C 'one':107C 'public':90C 'request':119C 'reus':94C 'send':113C 'server':69C,80C 'sign':115C 'ssh':89C,116C 'synergi':68C 'userauth':118C 'usernam':100C,123C 'vulner':87C 'x':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127090","severity":null,"published_at":"2026-11-13T10:18:05+00:00","modified_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145314,"url":"https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145315,"url":"https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}