← Vulnerability feed

Vulnerability record · CVE-2018-7749 · published 12 March 2018

CVE-2018-7749: Asyncssh project asyncssh improper authentication vulnerability

Asyncssh Project · Asyncssh

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.

9.8 CVSS 3.0 Critical EPSS 1.8% · top 21.4% CWE-287 · Improper authentication
9.8CVSS 3.0 base score, v2 7.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4 Third Party Advisory
https://groups.google.com/forum/#%21msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ
https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4 Third Party Advisory
https://groups.google.com/forum/#%21msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ

Track CVE-2018-7749 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-45309Asyncssh project asyncssh path traversal vulnerabilityAsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio frame…EPSS 0.59%6.8CVE-2023-46446Asyncssh project asyncssh insecure direct object reference vulnerabilityAn issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulati…EPSS 0.93%5.9CVE-2023-48795SSH Terrapin attack downgrades channel integrity in OpenSSH and many SSH implementationsThe SSH transport protocol with certain OpenSSH extensions mishandles the handshake and sequence numbers, letting a remote attacker omit packets from…EPSS 94%analysed5.9CVE-2023-46445Asyncssh project asyncssh insufficient verification of data authenticity vulnerabilityAn issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Ext…EPSS 0.62%9.8CVE-2026-102895Gpustack improper authentication vulnerabilityGPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/a…KEVEPSS 0.52%5.5CVE-2024-27834Apple safari improper authentication vulnerabilityThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonom…KEVEPSS 1.5%6.9CVE-2026-105133Ahsay cloud backup suite improper authentication vulnerabilityA vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStru…KEVEPSS 84%7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 10.0%analysed

Source: NIST National Vulnerability Database (record CVE-2018-7749), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.