‼️WARNING - OpenSSH issues emergency fix for a critical SSH authentication bypass on Alpine Linux.

A password longer than 256 bytes can unlock key-only accounts on affected servers, without knowing the actual credentials.

Here's how it works ↓ thehackernews.com/2026/11/openss…

Here's the strange part:

On affected Alpine Linux servers, SSH rejects a wrong password but can accept ANY password between 257 and 1,024 bytes for an account with no password set.

One long string is enough. No brute force needed.

Not every Alpine Linux server is vulnerable.

The bypass requires:
• SSH password logins enabled
• Password checks without PAM
• An account with no password set
• Another account with a compatible password hash

Key-only accounts can be exposed too.

It gets worse on certain Alpine cloud images.

The alpine user has passwordless doas access. If the SSH bypass conditions are met, an attacker can log in as alpine and become root.

OpenSSH and Alpine have released fixes.

Can't update yet? Set PasswordAuthentication no and restart sshd.