Atsign NoPorts Vulnerabilities Let Any atSign Gain SSH Access
Remote-access systems without open ports are meant to shrink the attack surface. Yet a single flaw in authorization checks can push the risk back up to the application layer. A UltraViolet Cyber researcher discovered two vulnerabilities in the sshnpd C daemon of the Atsign NoPorts platform. Together, they could have allowed the holder of any valid atSign identity to obtain unauthorized SSH access.
How NoPorts Is Meant to Work
NoPorts does not publish an SSH service on the network. Instead, it builds an encrypted session through relay infrastructure after cryptographically verifying the sender. In the vulnerable C implementation of sshnpd, the message was indeed checked for authenticity. However, the daemon failed to match the sender against its list of trusted managers before processing session, SSH, and tunnel requests.
The Second Flaw: Inverted Key Validation
The second bug surfaced when the daemon ran with the -s flag, which permits the transfer of SSH public keys. The function was supposed to verify a valid key prefix. Because of several errors, though, the comparison worked in reverse: unsuitable data was treated as correct. As a result, material sent by an attacker could reach the code that writes a key into authorized_keys.
Chaining the Two Errors
Combined, the two flaws created a technically viable chain. The holder of any valid atSign identity could request a session without administrative rights, transmit their own SSH key, secure its entry into authorized_keys, and then connect to localhost:22 through the NoPorts relay using the added key. Notably, no password theft, memory corruption, or protocol tampering was required.
Who Was Most Exposed
The problem particularly affected systems where NoPorts was adopted precisely to abandon inbound SSH connections, VPNs, and exposed management interfaces. Ordinary network scanning would not have revealed such a vulnerability, since the weak point lay in message-processing logic. Moreover, UltraViolet Cyber describes the technical chain and reports no confirmed attacks in real-world environments.
Disclosure, Patch, and Recommendations
Atsign received the report on 21 August and released a corrected version on 25 August 2026, while a CVE-assignment request remains under review. UltraViolet Cyber advises updating the C daemon urgently, verifying the installed version, reviewing authorized_keys for unfamiliar keys, and checking the –manager list. For similar systems, it also recommends confirming that users without the necessary rights are duly denied.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
