CVE-2026-127090 json
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
published 2d ago modified yesterday also EUVD-2026-125093
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account.
Patch / fix
- Jadaptive Maverick Synergy Server 3.0.33, 3.1.7
- Jadaptive Maverick Legacy Server 1.8.1
Is CVE-2026-127090 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- yesterday
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Jadaptive Maverick Synergy Server
- Jadaptive Maverick Legacy Server
Classification
- Weakness
-
- CWE-305 Authentication Bypass by Primary Weakness
References
-
github.com
/sshtools/maverick-synergy/commit/f7d23182cce985e21048215e96395881295cb0bd
patch
-
jadaptive.com
/security/advisories/JADAPTIVE-SA-2026-001
vendor-advisory
-
store.jadaptive.com
/app/api/releases/changes/01d04a39-0f05-4bae-842e-d2f1acc16985
release-notes
-
store.jadaptive.com
/app/api/releases/changes/ff71bdcf-a2a2-47e0-af5a-22e15af1dfa4
release-notes
-
github.com
/sshtools/maverick-synergy/blob/3.1.4/maverick-base/src/main/java/com/sshtools/common/auth/PublicKeyAuthentica
technical-description
-
github.com
/sshtools/maverick-synergy/blob/3.1.4/maverick-synergy-server/src/main/java/com/sshtools/server/Authentication
technical-description
-
vulncheck.com
/advisories/jadaptive-maverick-synergy-server-before-3.0.33-and-3.1-x-before-3.1.7-and-maverick-legacy-server-
third-party-advisory
Sources
- CVE List CVE-2026-127090
- NVD CVE-2026-127090
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.