Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*

1 brief RSS
critical threat

golang.org/x/crypto/ssh FIDO/U2F Physical Presence Bypass (CVE-2026-39831)

A critical vulnerability (CVE-2026-39831) in the `Verify()` method of the `golang.org/x/crypto/ssh` package (versions prior to 0.52.0) allowed the physical presence check for FIDO/U2F security key types to be bypassed, enabling unattended use of hardware security keys and potentially leading to unauthorized SSH access.

exploited golang.org/x/crypto/ssh ssh vulnerability golang fido u2f
1c