The openssh-server package on Alpine Linux contains a password authentication bypass vulnerability in builds where PAM is not enabled. To exploit it, an attacker must meet three conditions: PasswordAuthentication is enabled, an account exists whose password field is set to *, and at least one account on the local machine uses a $5$ or $6$ hash. Once these conditions are satisfied, the attacker can log in without the correct password by submitting an overly long passphrase. Affected versions include Alpine 3.16 through 3.24 and the edge version. Systems running openssh-server-pam with UsePAM set to yes, as well as systems where password login has been disabled, are not affected. No CVE has yet been assigned to this vulnerability. The root cause is that, without PAM, the salt of another account is borrowed, and musl's crypt() returns * for overly long passphrases. A related patch has been released, and users should upgrade the package and restart sshd. Those unable to upgrade immediately can disable password authentication as a workaround. Notably, the alpine user in the official tiny-cloud image carries the risk of being exploited to escalate privileges to root.