---
id: CVE-2026-83540
title: >-
  When password or public key authentication is used with the Windows port of
  wolfSSHd, the Windows logon token acquired for one authenticated connection is
  not released before a token is acquired for a subsequent connection, resulting
  in …
summary: >-
  When password or public key authentication is used with the Windows port of
  wolfSSHd, the Windows logon token acquired for one authenticated connection is
  not released before a token is acquired for a subsequent connection, resulting
  in …
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-287
  - CWE-613
vendor: wolfSSL
product: wolfSSH
affected:
  - wolfSSH >= 1.4.15 <= 1.5.0
published: '2026-10-07'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T16:02:27.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83540'
references:
  - url: 'https://github.com/wolfSSL/wolfssh'
    label: facts@wolfssl.com
  - url: >-
      https://github.com/wolfSSL/wolfssh/commit/9777bc5ce810d6c418a1473e9e8c40cdb0026e5a
    label: facts@wolfssl.com
  - url: >-
      https://github.com/wolfSSL/wolfssh/commit/b6bd975ccfac6aadf29b98e35e09114bef3840a9
    label: facts@wolfssl.com
  - url: 'https://www.wolfssl.com/docs/security-vulnerabilities/'
    label: facts@wolfssl.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-07T11:28:54.655733Z'
cvssSource: cna
ingestedAt: '2026-10-07T03:28:55.182Z'
---

## Overview

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.