Strip the -s flag and the first bug still matters. The dispatch path confirms a request was cryptographically signed by a legitimate atSign, then runs the session-request, SSH-request and tunnel-request handlers without comparing that identity against the configured manager list [3]. That alone turns the daemon into a broker. Any holder of a valid atSign can ask for relay connectivity to a service the operator deliberately never published to the network [4]. Key injection is the part that turns reachability into a login, and it requires the daemon to have been started with -s, which enables SSH public-key sharing [5].
The validation on that path fails in three ways inside one function. It measures the wrong string, adds a bounds check that can never fire, and inverts the return of strncmp() so a prefix mismatch reads as a match, which lets arbitrary attacker-supplied key material through to the code that writes authorized_keys [6]. Chained, the sequence is ordinary product behaviour: request a session as an unauthorized identity, submit a key the broken check accepts, let the daemon write it to authorized_keys, then use the daemon's own relay to reach localhost:22 and authenticate with it [7]. The advisory notes the chain skips memory corruption and credential theft entirely, and it manipulates no protocol along the way, which is also why conventional monitoring is unlikely to flag it [8].
The dates are tight. Zonifer filed on August 21, Atsign shipped a patched release on August 25 [9], and the UltraViolet Cyber advisory carrying the findings was published on August 25, 2026 [10]. That is four days from report to fix [11], and the patch was available the same day the technical detail went public [12].
The Dart implementation contains the manager check the C port omitted [13], which puts the defect in the reimplementation rather than in the protocol specification the Atsign Foundation maintains [17].
What the advisory does not carry is a CVE identifier, because the request is still pending [14]. It also reports no exploitation in the wild and gives no figures for how many deployments run the C daemon or how many run it with -s [18]. UltraViolet Cyber says its TIDE team has begun implementing detections and running threat hunts against Atsign infrastructure in customer environments [15]; that is preparation, not evidence of activity. Both accounts trace to one researcher, the UVCyber advisory and Zonifer's own writeup [16], and UVCyber's own guidance is that anyone running the C implementation should treat this as a priority [19].
For an operator the identifying question is narrow and answerable without a CVE: which hosts run the C sshnpd instead of the Dart daemon, and which of those were launched with -s.
