Timing Discrepancy Vulnerability in Erlang/OTP Affecting SSH Authentication

CVE-2026-48859

What is CVE-2026-48859?

A vulnerability in Erlang/OTP's SSH modules allows unauthenticated remote username enumeration through observable timing discrepancies during password authentication. When using the user_passwords or password options, the system will take significantly longer to respond for valid usernames due to a lengthy PBKDF2-SHA256 computation, whereas invalid usernames lead to an immediate response. This inconsistency can be utilized by attackers in a single authentication attempt, making it easy to detect valid usernames. It is recommended that users switch to using the pwdfun option to mitigate this vulnerability, as the current configurations are primarily intended for testing purposes.

References