The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
{ "github_reviewed_at": "2023-08-03T22:53:06Z", "severity": "CRITICAL", "nvd_published_at": "2018-03-12T19:29:00Z", "github_reviewed": true, "cwe_ids": [ "CWE-287" ] }