{"id":"CVE-2026-83540","revision":"1363ee5043cc43b39a9266c15cc8d024","records":[{"revision":"1363ee5043cc43b39a9266c15cc8d024","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-83540","aliases":[],"title":"wolfSSHd on Windows race condition leading to logon token reused across connections","description":"When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.","state":0,"publishedAt":"2026-10-07T02:40:35.137+00:00","modifiedAt":"2026-10-07T11:29:08.132+00:00","affected":[{"ecosystem":"https://github.com/wolfSSL/wolfssh","name":"wolfSSH","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wolfSSL\",\n                    \"product\": \"wolfSSH\",\n                    \"platforms\": [\n                        \"Windows\"\n                    ],\n                    \"collectionURL\": \"https://github.com/wolfSSL/wolfssh\",\n                    \"repo\": \"https://github.com/wolfSSL/wolfssh\",\n                    \"modules\": [\n                        \"wolfSSHd\"\n                    ],\n                    \"programFiles\": [\n                        \"apps/wolfsshd/auth.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"SetupUserTokenWin\"\n                        },\n                        {\n                            \"name\": \"CheckPasswordWIN\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.4.15\",\n                            \"lessThanOrEqual\": \"1.5.0\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"1.6.0\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.7,"severity":"HIGH"}],"references":["https://github.com/wolfSSL/wolfssh","https://github.com/wolfSSL/wolfssh/commit/b6bd975ccfac6aadf29b98e35e09114bef3840a9","https://github.com/wolfSSL/wolfssh/commit/9777bc5ce810d6c418a1473e9e8c40cdb0026e5a","https://www.wolfssl.com/docs/security-vulnerabilities/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-83540","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-83540","identifiers":["CVE-2026-83540"]},"retained":false,"historicalAffected":[]}],"coverage":[]}