GoKawiilDecade-old flaw lets attackers SSH into Alpine Linux devices without a password
Researchers disclosed a vulnerability stemming from how OpenSSH interacts with musl, the lightweight C library used by Alpine Linux, when PAM authentication is not used. On systems meeting specific conditions—including passwordless accounts marked with an asterisk in /etc/shadow and at least one SHA256/SHA512-hashed account—an attacker can log in via SSH without any password, succeeding on the first attempt with no retries needed.