OpenSSH flaw lets attackers log into password-disabled Linux accounts

A vulnerability in OpenSSH, present since 2016, allowed attackers to bypass password-disabled account restrictions on musl-based Linux systems (such as Alpine Linux) by sending an oversized password string when PAM is disabled. This meant accounts explicitly configured to reject password authentication — including default 'alpine' root accounts — could be silently compromised, potentially granting full root access. The flaw highlights how dangerous default credentials and misconfigured authentication stacks can be when combined with an unpatched vulnerability. It matters because Alpine Linux is widely used in containerized and cloud-native environments, dramatically broadening the attack surface. The fix has been available since OpenSSH 10.6p2, making timely patching the most direct mitigation.