CVE-2026-62325: CVE-2026-62325: Authentication Bypass in goshs SFTP Server via Missing Password Check

CVE-2026-62325: Authentication Bypass in goshs SFTP Server via Missing Password Check

Vulnerability ID: CVE-2026-62325
CVSS Score: 9.1
Published: 2026-07-28

A critical authentication bypass vulnerability in the SFTP server module of goshs version 2.1.3 allows remote, unauthenticated attackers to read, write, modify, or delete files on the target hosting environment. This vulnerability is caused by an incomplete logic check during initialization that falls back to a password-less configuration when an empty password string is specified.

TL;DR

Configuring the goshs file server with an empty password causes the SFTP engine to bypass password handler registration. This defaults the underlying gliderlabs/ssh library to NoClientAuth=true, allowing unauthenticated network clients to gain full SFTP access.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-306
• Attack Vector: Network
• CVSS v3.1 Score: 9.1 (Critical)
• Exploit Status: Proof of Concept (PoC) Available
• KEV Status: Not Listed
• Impact: High (Confidentiality and Integrity)

Affected Systems

• goshs
• github.com/patrickhener/goshs/v2
• goshs.de/goshs/v2
• goshs: >= 2.1.3, < 2.1.4 (Fixed in: 2.1.4)

Code Analysis

Commit: 32f4a0e

Fix: authentication bypass in SFTP mode by changing the logical condition from AND to OR during password handler registration

diff --git a/sftpserver/sftpserver.go b/sftpserver/sftpserver.go
index bbc5a2c..b89e7e1 100
--- a/sftpserver/sftpserver.go
+++ b/sftpserver/sftpserver.go
@@ -82,7 +82,7 @@ func (s *SFTPServer) Start() error {
        sshServer.HostSigners = []ssh.Signer{private}
    }

-   if s.Username != "" && s.Password != "" {
+   if s.Username != "" || s.Password != "" {
        sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {
            return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 && subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1
        }

Exploit Details

• GitHub Security Advisory: Full advisory with architectural context, impact, mitigation steps, and proof-of-concept description.

Mitigation Strategies

• Upgrade goshs binary to v2.1.4 or higher
• Ensure basic authentication passwords are non-empty when using SFTP
• Configure key-based authentication with -fkf to enforce key verification
• Restrict network access to SFTP port 2121 using localized firewall structures

Remediation Steps:

1. Audit all active processes to detect running instances of goshs.
2. Check command-line flags for configurations utilizing basic authentication with empty passwords (e.g., matching the regex pattern -b ['"]?[a-zA-Z0-9_-]+:['"]?).
3. Kill the active process and download the latest version v2.1.4 release.
4. Restart the service with strong, non-empty basic authentication credentials.

References

• GitHub Security Advisory GHSA-rjrw-mjq6-hpmm
• Authentication Fix Commit
• goshs v2.1.4 Release
• goshs Project Repository

---

Read the full report for CVE-2026-62325 on our website for more details including interactive diagrams and full exploit analysis.