CVE-2026-39831
A critical flaw in OpenSSH’s FIDO/U2F security key handling allows signatures to be accepted without the required user touch. This means an attacker could use a stolen key without physical interaction. The vulnerability arises from the Verify() method not checking the User Presence flag.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
golang crypto library, specifically the FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com. Users running affected versions of the golang crypto package are at risk.
Real-world impact
An attacker could use a stolen or compromised hardware security key to sign authentication requests without needing to physically touch the key, enabling unauthorized access to systems that rely on FIDO/U2F authentication.
Why this severity
The CVSS score of 9.1 reflects the high impact: the vulnerability is exploitable over the network, requires no privileges or user interaction, and can compromise confidentiality and integrity of authentication. The lack of a user presence check allows attackers to bypass the intended security measure, leading to critical risk.
What to do about it
- ›Avoid using FIDO/U2F authentication with this software until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- go.dev/cl/781662issue tracking
- go.dev/issue/79566issue tracking
- groups.google.com/g/golang-announce/c/a082jnz…mailing list
- pkg.go.dev/vuln/GO-2026-5019vendor advisory