CVE-2026-48859

@@ -378,7 +378,7 @@ handling plugin `m:ssh_file`. The alternatives are:
 
   ```erlang
   fun(User, Password, _PeerAddress, State) ->
-          case lists:member({User,Password}, my_user_pwds()) of
+          case check_credentials(User, Password) of
               true ->
                   {true, undefined}; % Reset delay time
               false when State == undefined ->
@@ -391,6 +391,14 @@ handling plugin `m:ssh_file`. The alternatives are:
   end.
   ```
 
+  > #### Warning {: .warning }
+  >
+  > A `pwdfun` implementation should take care to execute in approximately
+  > the same time regardless of whether the username is valid or invalid.
+  > A timing difference allows attackers to enumerate valid usernames.
+  > Use constant-time comparison for password checking and avoid early
+  > returns based on username validity.
+
   If a public key is used for logging in, there is normally no checking of the
   user name. It could be enabled by setting the option
   [`pk_check_user`](`m:ssh#option-pk_check_user`) to `true`. In that case the

@@ -519,6 +519,8 @@ check_password(User, Password, #ssh{opts=Opts} = Ssh) ->
                 Checker when is_function(Checker, 1) ->
                     {Checker(Password), Ssh};
                 _ ->
+                    %% Run fake PBKDF2 to prevent timing oracle (GHSA-3w6p-vwhf-wvp4)
+                    _ = (?GET_INTERNAL_OPT(fake_passwd_checker, Opts))(Password),
                     {false, Ssh}
             end;
 
@@ -550,7 +552,7 @@ get_password_option(Opts, User) ->
 	{value, {User, Pw}} -> Pw;
 	false -> ?GET_OPT(password, Opts)
     end.
-	    
+
 pre_verify_sig(User, KeyBlob,  #ssh{opts=Opts}) ->
     try
 	Key = ssh_message:ssh2_pubkey_decode(KeyBlob), % or exception

@@ -43,8 +43,7 @@
          no_sensitive/2,
          initial_default_algorithms/2,
          check_preferred_algorithms/1,
-         merge_options/3
-        ]).
+         merge_options/3]).
 
 -export_type([private_options/0
              ]).
@@ -231,11 +230,10 @@ handle_options(Role, OptsList0, Opts0) when is_map(Opts0),
                ]
               },
               OptionDefinitions),
-
-
         %% Enter the user's values into the map; unknown keys are
         %% treated as socket options
-        check_and_save(OptsList2, OptionDefinitions, InitialMap)
+        maybe_add_fake_passwd_checker(Role,
+                                      check_and_save(OptsList2, OptionDefinitions, InitialMap))
     catch
         error:{EO, KV, Reason} when EO == eoptions ; EO == eerl_env ->
             if
@@ -253,7 +251,16 @@ check_and_save(OptsList, OptionDefinitions, InitialMap) ->
       lists:foldl(fun(KV, Vals) ->
                           save(KV, OptionDefinitions, Vals)
                   end, InitialMap, OptsList)).
-    
+
+maybe_add_fake_passwd_checker(server, Options) ->
+    case ?GET_OPT(pwdfun, Options) of
+        undefined ->
+            ?PUT_INTERNAL_OPT({fake_passwd_checker, make_passwd_fun("fake")}, Options);
+        _ ->
+            Options
+    end;
+maybe_add_fake_passwd_checker(_Client, Options) ->
+    Options.
 
 cnf_key(server) -> server_options;
 cnf_key(client) -> client_options.

@@ -57,6 +57,9 @@
          max_sessions_drops_tcp_connects/0,
 	 server_password_option/1, 
 	 server_userpassword_option/1, 
+	 server_userpassword_timing/0,
+	 server_userpassword_timing/1,
+	 server_pubkey_timing/1,
 	 server_pwdfun_option/1,
 	 server_pwdfun_4_option/1,
 	 server_keyboard_interactive/1,
@@ -124,6 +127,8 @@ all() ->
      connectfun_disconnectfun_client,
      server_password_option,
      server_userpassword_option,
+     server_userpassword_timing,
+     server_pubkey_timing,
      server_pwdfun_option,
      server_pwdfun_4_option,
      server_keyboard_interactive,
@@ -2294,3 +2299,64 @@ test_not_connect(Config, Host, Port, Opts) ->
         error:{badmatch, {error,_}} -> ok
     end.
 
+
+%%--------------------------------------------------------------------
+%% Verify that password auth timing does not reveal username validity.
+%% Regression test for GHSA-3w6p-vwhf-wvp4.
+server_userpassword_timing() ->
+    [{timetrap, {seconds,60}}].
+
+server_userpassword_timing(Config) when is_list(Config) ->
+    UserDir = proplists:get_value(user_dir, Config),
+    SysDir = proplists:get_value(data_dir, Config),
+    {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SysDir},
+                                             {user_dir, UserDir},
+                                             {auth_methods, "password"},
+                                             {user_passwords, [{"alice", "s3cret"}]}]),
+    Opts = [{silently_accept_hosts, true},
+            {user_interaction, false},
+            {save_accepted_host, false},
+            {auth_methods, "password"},
+            {user_dir, UserDir},
+            {password, "wrong"}],
+    F = fun(User) -> time_auth(Host, Port, User, Opts) end,
+    ssh_test_lib:assert_timing_symmetry(F, "alice", "invalid"),
+    ssh:stop_daemon(Pid).
+
+%%--------------------------------------------------------------------
+%% Verify that pubkey auth with pk_check_user timing does not reveal
+%% username validity. Regression test for GHSA-3w6p-vwhf-wvp4.
+server_pubkey_timing(Config) when is_list(Config) ->
+    UserDir = proplists:get_value(priv_dir, Config),
+    SysDir = proplists:get_value(data_dir, Config),
+    %% Server user_dir has no authorized_keys, so pubkey auth fails
+    %% for both users. This isolates the pk_check_user timing from
+    %% auth success/failure differences.
+    ServerUserDir = filename:join(UserDir, "srv_no_authkeys"),
+    ok = file:make_dir(ServerUserDir),
+    ssh_test_lib:setup_all_user_host_keys(Config),
+    {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SysDir},
+                                             {user_dir, ServerUserDir},
+                                             {auth_methods, "publickey"},
+                                             {user_passwords, [{"alice", "s3cret"}]},
+                                             {pk_check_user, true}]),
+    Opts = [{silently_accept_hosts, true},
+            {user_interaction, false},
+            {save_accepted_host, false},
+            {auth_methods, "publickey"},
+            {user_dir, UserDir}],
+    F = fun(User) -> time_auth(Host, Port, User, Opts) end,
+    ssh_test_lib:assert_timing_symmetry(F, "alice", "invalid"),
+    ssh:stop_daemon(Pid).
+
+time_auth(Host, Port, User, Opts) ->
+    T0 = erlang:monotonic_time(millisecond),
+    Result = ssh:connect(Host, Port, [{user, User} | Opts]),
+    T1 = erlang:monotonic_time(millisecond),
+    case Result of
+        {ok, C} -> ssh:close(C);
+        _ -> ok
+    end,
+    Delta = T1 - T0,
+    ?CT_LOG("Connection result = ~p in ~p ms", [Result, Delta]),
+    Delta.

@@ -142,7 +142,9 @@ remove_comment/1
 -export([log/2,
          get_log_level/0, set_log_level/1,
          add_log_handler/2, rm_log_handler/1,
-         get_log_events/1]).
+         get_log_events/1,
+         median/1,
+         assert_timing_symmetry/3]).
 
 -include_lib("common_test/include/ct.hrl").
 -include("ssh_transport.hrl").
@@ -1593,3 +1595,36 @@ get_public_key_algorithms_with_valid_host_key(Config, Options) ->
     Opts = #{key_cb => KeyCb, key_cb_options => [{system_dir, system_dir(Config)}]},
     PubKeyAlgs = ssh_transport:supported_algorithms(public_key),
     lists:filter(fun(Alg) -> ?HAS_HOST_KEY(Alg, Opts) end, PubKeyAlgs).
+
+median(List) ->
+    Sorted = lists:sort(List),
+    Len = length(Sorted),
+    case Len rem 2 of
+        1 -> lists:nth((Len + 1) div 2, Sorted);
+        0 -> (lists:nth(Len div 2, Sorted) +
+                  lists:nth(Len div 2 + 1, Sorted)) / 2
+    end.
+
+assert_timing_symmetry(MeasureFun, ValidInput, InvalidInput) ->
+    N = 8,
+    Warmup = 3,
+    CollectSamples =
+        fun(Input) ->
+                lists:sublist(
+                  [begin
+                       ?CT_LOG("Collecting sample #~p of total ~p", [I, N]),
+                       MeasureFun(Input)
+                   end || I <- lists:seq(1, N)],
+                  Warmup + 1, N - Warmup)
+        end,
+    MV = median(CollectSamples(ValidInput)),
+    MI = median(CollectSamples(InvalidInput)),
+    Ratio = max(MV / MI, MI / MV),
+    ?CT_LOG("Valid(~p) median=~p ms, Invalid(~p) median=~p ms, Ratio=~.2f",
+            [ValidInput, MV, InvalidInput, MI, Ratio]),
+    case Ratio > 3.0 of
+        true ->
+            ct:fail("Timing ratio ~.2f exceeds 3.0 — possible timing oracle", [Ratio]);
+        false ->
+            ok
+    end.