CVE-2026-48859: Erlang/OTP SSH Timing Side-Channel Username Enumeration

Technical summary

CVE-2026-48859 is an observable timing discrepancy (CWE-208) in Erlang/OTP ssh modules ssh_auth and ssh_options. The vulnerability exists in the password authentication path: when user_passwords or password options are configured, the ssh_auth:check_password/3 function performs a computationally expensive PBKDF2-SHA256 operation with 600,000 iterations for valid usernames, incurring approximately 300ms latency. For invalid usernames, the ssh_options:get_password_option/2 function returns immediately without performing the key derivation, resulting in near-zero latency. This timing delta is statistically detectable in a single authentication attempt and enables username enumeration. The recommended pwdfun callback mechanism performs consistent-time validation and is not susceptible to this attack vector. The vulnerability affects Erlang/OTP versions 29.0.0 through 29.0.1 (ssh 6.0.0 through 6.0.0).

Business impact

Username enumeration undermines SSH access control security by reducing attacker reconnaissance effort. An adversary can systematically discover valid accounts before attempting password attacks, dictionary attacks, or social engineering—significantly improving campaign success rates. While the vulnerability requires network access and yields only account names (not credentials), the low barrier to exploitation and high value of discovered usernames make this a meaningful security concern for SSH-exposed systems. Organizations relying on username obscurity or rate-limiting as compensating controls should prioritize remediation. The impact is primarily confidentiality; integrity and availability are not directly threatened.

Affected systems

Erlang/OTP versions 29.0.0 and 29.0.1 with SSH module versions 6.0.0 are affected. Only SSH daemons explicitly configured with the user_passwords or password authentication options are vulnerable; these are documented legacy options intended for testing environments. Servers using the recommended pwdfun callback or other authentication methods (public key, keyboard-interactive without the vulnerable password options) are not affected. Organizations should audit SSH configurations for these specific options—they are typically absent in production deployments but may persist in development, staging, or inherited configurations.

Exploitability

Exploitability is straightforward and does not require authentication, special privileges, or user interaction. An attacker needs only network access to the SSH port and can execute the attack with standard SSH clients by measuring login attempt latency. No configuration bypass or cryptographic attacks are necessary. The timing difference is large enough (300ms vs. near-0ms) to be reliably detected over a network even with variable latency, though local or nearby network positions improve precision. The attack is passive from the server's perspective and leaves minimal forensic traces. Threat actors do not appear to be actively weaponizing this vulnerability according to available threat intelligence, and it is not tracked on the CISA KEV catalog, but the low technical barrier means rapid exploitation adoption is possible if the vulnerability gains prominence.

Remediation

Upgrade Erlang/OTP to version 29.0.2 or later, which addresses the timing discrepancy by ensuring consistent processing time regardless of username validity. Alternatively, migrate SSH authentication configurations from user_passwords or password options to the recommended pwdfun callback mechanism, which performs constant-time validation. Interim mitigation: disable user_passwords and password options and use alternative authentication methods (public key, Kerberos, or keyboard-interactive with custom callbacks). Organizations should verify that no legacy configurations remain after patching, as pre-existing systems may retain deprecated options in startup scripts or configuration management tools.

Patch guidance

Erlang/OTP 29.0.2 and later contain the fix. Verify your current version with `erl -version` (OTP version line) and `ssh:module_info(attributes)` within an Erlang shell to confirm ssh module version. Patch deployment requires restarting SSH services; plan accordingly for production systems. After patching, audit SSH daemon configuration files (typically /etc/ssh/sshd_config or application-specific SSH configs in Erlang deployments) to confirm user_passwords and password options are not present. If found, transition to pwdfun-based authentication. Consult the Erlang/OTP release notes for version 29.0.2 and the vendor advisory for detailed migration guidance.

Detection guidance

Detection focuses on configuration and suspicious login patterns. Review SSH configuration files for the presence of user_passwords or password options—these should trigger immediate investigation and remediation. At the network level, monitor for high-frequency SSH login attempts from a single source to a varying set of usernames with consistent timing probes; this pattern is characteristic of timing-based enumeration. SSH log analysis can identify repeated failed logins across multiple accounts from one IP, though the attack may use distributed sources. Implement SSH login rate limiting and IP-based access controls to raise attacker friction. If timing-based detection is needed, inspect SSH access logs for authentication events and correlate response times, though this requires custom instrumentation beyond standard sshd logging.

Why prioritize this

Priority should be moderate-to-high for systems explicitly using user_passwords or password SSH options, and low for all others. Assess your environment quickly: most production deployments will be unaffected because these options are legacy test mechanisms. For affected configurations, the ease of exploitation and direct value to attackers (account enumeration) warrant prompt patching. Organizations with public-facing SSH services, multiple user accounts, or reliance on username confidentiality should prioritize. The CVSS score of 5.3 (MEDIUM) reflects the confidentiality impact and low attack complexity, but is not on the CISA KEV catalog, suggesting no active exploitation in the wild at publication—a window to remediate before threat actor adoption.

Risk score, explained

CVE-2026-48859 carries a CVSS 3.1 score of 5.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This reflects network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and a limited scope impact (S:U) affecting only confidentiality (C:L, impact is username disclosure). The score does not account for configuration prevalence or threat actor interest, which further reduce practical risk for most deployments. Organizations using the vulnerable configuration should treat as high-priority in their environment; others can deprioritize behind more impactful CVEs.

Frequently asked questions