CVE-2026-46595: golang.org/x/crypto/ssh VerifiedPublicKeyCallback Source-Address Authorization Bypass

// Attacker connects from a source IP not listed in the key's
// source-address restriction, targeting a server that sets ONLY
// VerifiedPublicKeyCallback (no PublicKeyCallback source-address check).
//
// Vulnerable server config (go < 0.52.0):
config := &ssh.ServerConfig{
    // PublicKeyCallback approves the key but never enforces source-address
    PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
        return &ssh.Permissions{}, nil // source-address NOT checked here
    },
    // VerifiedPublicKeyCallback is invoked post-signature; source-address
    // restriction in Permissions.Extensions is silently ignored here too
    VerifiedPublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey, perms *ssh.Permissions, algo string) (*ssh.Permissions, error) {
        return perms, nil // bypass: source-address extension never enforced
    },
}
// Attacker triggers auth from 10.0.0.99 (blocked address):
// ssh -i attacker_key -o "SourceAddress 10.0.0.99" user@target
// Result: authentication SUCCEEDS despite source-address restriction