CVE-2026-54590CWE-22CWE-639

AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

Medium · published July 8, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-08T20:36Z
EPSS history
Timeline
  • 08 JUL 20:36Z
    AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion
    cvelistv5