CVE-2007-2768: OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine t...

Security readout for executives and security teams

This CVE describes a user-enumeration weakness in OpenSSH deployments that use OPIE one-time passwords through PAM. A remote attacker may be able to tell whether certain accounts exist based on different authentication responses. The bundle does not provide a CVSS score, confirmed affected versions, or a vendor fix. Exposure appears limited to SSH services configured with PAM-based OPIE, S/Key, or similar OTP behavior. Standard OpenSSH deployments without that authentication path may not be affected, but the bundle lacks authoritative affected-version data. Prioritize internet-facing SSH systems that still use legacy one-time-password authentication. This is mainly reconnaissance risk, but valid usernames can improve password attacks and phishing targeting. Mitigation focus: Check vendor advisories for affected versions and supported fixes.; Inventory SSH servers using PAM-based OPIE, S/Key, or OTP.; Apply OpenSSH or platform updates when vendor guidance identifies a fix..

Prepared

Jun 29, 2026, 05:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.