Alpine Linux OpenSSH Flaw Lets Anyone Log In Without a Password
Alpine Linux Security advisory: OpenSSH-server password authentication bypass
A critical bug in Alpine's OpenSSH server lets an attacker log in as any passwordless account by sending a long password — no retries needed. One account with a $5$ or $6$ hash is enough to expose every account with a '*' password field, including root and the tiny-cloud 'alpine' user. Every Alpine release from 3.16 through edge is affected. Upgrade openssh and restart sshd, or set PasswordAuthentication no.
musl's crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the "hash" matches and the login succeeds.