CVE-2026-48859 Details

A timing discrepancy vulnerability in the SSH implementation of Erlang/OTP has been identified, specifically within the ssh_auth and ssh_options modules. This vulnerability allows unauthenticated remote username enumeration through a timing side-channel during password authentication. When the SSH daemon uses the user_passwords or password option, the function ssh_auth:check_password/3 hashes passwords for valid usernames using PBKDF2-SHA256 with 600,000 iterations, taking approximately 300 milliseconds. In contrast, invalid usernames are processed almost instantly, creating a detectable timing difference that can be exploited to identify valid usernames. This issue affects Erlang/OTP versions 29.0 prior to 29.0.2, corresponding to SSH versions 6.0 prior to 6.0.1.

Users are advised to switch from the user_passwords or password options to the pwdfun option for password authentication, as the latter is not affected by this vulnerability. Additionally, restrict access to the SSH port from untrusted networks to mitigate the risk of exploitation.