---
id: "CVE-2026-127090"
page: "https://infrastack.ai/live/CVE-2026-127090"
kind: "vulnerability"
aliases: ["CVE-2026-127090"]
title: "Maverick Synergy SSH server: key auth lets attackers log in as other users"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "java", "maverick-legacy", "maverick-synergy", "ssh"]
not_affected_if: ["no-ssh-exposure", "password-only-auth"]
published_at: "2026-11-13T10:18:05+00:00"
first_seen_at: "2026-11-13T10:47:30+00:00"
updated_at: "2026-11-13T10:48:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127090", "first_seen_at": "2026-11-13T10:47:30+00:00"}]
exploit_sources: []
---

# Maverick Synergy SSH server: key auth lets attackers log in as other users

Link for people: https://infrastack.ai/live/CVE-2026-127090 (this .md is for agents)

Maverick Synergy and Maverick Legacy SSH servers cache public key authorization decisions across usernames on a connection. An attacker holding a key authorized for one account can log in as a different account on the same connection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Maverick Synergy Server version and confirm it is at or above `3.0.33` or `3.1.7`
- Check the installed Maverick Legacy Server version and confirm it is at or above `1.8.1`

## Fix

- Maverick Synergy Server: move to `3.0.33` (for the 3.0 line) or `3.1.7` (for the 3.1 line)
- Maverick Legacy Server: move to `1.8.1`

## Timeline

- 2026-11-13T10:47:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127090

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-before-1.8.1-ssh-public-key-cross-user-authentication-bypass
- [fix] Patch: github.com https://github.com/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd

## From the sources

Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_