OpenSSH flaw lets attackers log into password-disabled Linux accounts

A newly disclosed OpenSSH vulnerability nicknamed '*sshole' allows attackers to authenticate into Linux accounts that have password authentication explicitly disabled. The flaw affects Alpine Linux and other musl libc-based Linux distributions. Attackers can exploit the vulnerability simply by submitting an oversized password string, bypassing the expected authentication block. This represents a significant authentication control bypass, particularly in environments relying on musl-based distributions for lightweight or container workloads. The issue is rooted in how musl libc handles password validation compared to glibc. Systems configured to disable password logins may falsely assume they are protected from password-based attacks. The vulnerability highlights risks in assumed security configurations on hardened or minimal Linux systems. Organizations using Alpine Linux in container environments (e.g., Docker) may be especially exposed.