A 257-Byte Password Is the Key: Inside the OpenSSH musl Bypass

CVE-2026-123158 lets an attacker log into a locked account on musl-based systems like Alpine by sending a password nobody set. The trigger is one number, 257, and the reason is a C library returning a single asterisk. I reproduced the exact boundary against musl 1.2.4 and read the fix.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.