Auth bypass in Wolfssl Wolfssh
CVE-2025-14942
wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the client into skipping user authentication. This affects client applications with wo…
Vulnerability class: Broken Authentication
EPSS: 0.001 (21.0th percentile) — read the EPSS interpretation.
Affected products
- Wolfssl Wolfssh — versions 0