CVE-2016-6210

Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux

Exploit for CVE-2026

Lightweight Linux distros vulnerable to *sshole password bypass

SSH Authentication Bypass on Alpine Linux: 257-Byte Password Authenticates as Root via musl crypt() Bug Decryption Digest - Cybersecurity Threat Intelligence / 52min A bug in musl libc's crypt() function lets any password of 257 bytes or longer authenticate as root, or as any user whose account is configured to accept only SSH keys, on Alpine Linux 3.16 and later. 257 — bytes is the minimum password length needed to trigger the musl crypt() failure that returns * and matches a locked account's s

Lightweight Linux distros vulnerable to *sshole password bypass iTnews - News / 15min Kültekin found that on distributions built around musl, such as Alpine, which is popular for Docker containers and cloud servers, an attacker could log in to a passwordless account by supplying an arbitrary password between 257 and 1024 characters long. A bug dubbed "*sshole" lets attackers log into passwordless accounts on musl-based Linux distributions using a password between 257 and 1024 characters long.

Exploit for CVE-2026