Alpine warns that OpenSSH password authentication can be bypassed with a single click.

November 6 — According to an official Alpine Linux security advisory, its openssh-server package has a password authentication bypass in builds without PAM enabled: an attacker who can connect to the SSH port can, under specific conditions, complete login in a single connection without the correct password. The conditions include PasswordAuthentication being enabled, the existence of an account whose password field is *, and at least one other account on the host with a $5$ or $6$ hash; an attacker can match successfully by submitting an overly long password to the passwordless account. The affected scope covers officially verified Alpine 3.21–3.24 and edge, as well as the discontinued 3.16–3.20; systems using openssh-server-pam with UsePAM yes, or with password login disabled, are not affected.

As of publication, no CVE has been assigned. Officials say the root cause is related to borrowing another account's salt when PAM is absent, and musl's crypt returning * for overly long passwords; OpenSSH 10.6p2 and patch packages for each stable branch have fixed it. It is recommended to immediately run apk upgrade and restart sshd; upgrading the package alone will not replace the running daemon; if upgrading is not possible for now, password authentication should be disabled. The alpine user in the official tiny-cloud image has a * password and can doas without a password; once a $6$ hash appears on the host, it may be exploited to gain root.