GO-2026-5019

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

At a glance

Published: 2026-05-22 02:08 UTC
Updated: 2026-09-17 10:41 UTC
CVE: CVE-2026-39831
Aliases: GHSA-89gr-r52h-f8rx

Description

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Affected packages

Package	Versions
Go · golang.org/x/crypto	introduced 0, fixed 0.52.0

References

https://go.dev/issue/79566 REPORT
https://groups.google.com/g/golang-announce/c/a082jnz-LvI WEB
https://go.dev/cl/781662 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database