The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/781662 | Issue Tracking |
| https://go.dev/issue/79566 | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/a082jnz-LvI | Mailing List |
| https://pkg.go.dev/vuln/GO-2026-5019 | Vendor Advisory |
Configurations
History
02 Jun 2026, 16:33
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Golang crypto
Golang |
|
| CWE | CWE-862 | |
| References | () https://go.dev/cl/781662 - Issue Tracking | |
| References | () https://go.dev/issue/79566 - Issue Tracking | |
| References | () https://groups.google.com/g/golang-announce/c/a082jnz-LvI - Mailing List | |
| References | () https://pkg.go.dev/vuln/GO-2026-5019 - Vendor Advisory | |
| CPE | cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* |
22 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
22 May 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-22 04:16
Updated : 2026-06-02 16:33
NVD link : CVE-2026-39831
Mitre link : CVE-2026-39831
CVE.ORG link : CVE-2026-39831
JSON object : View
Products Affected
golang
- crypto
CWE
CWE-862
Missing Authorization