In "russh/src/server/encrypted.rs", "server_read_auth_request_pk" (0.63.3, around lines 880-990): * The requested algorithm name ("pubkey_algo") is read and only used to decode the key: "PublicKeyOrCertificate::decode(&pubkey_algo, &pubkey_key)". The derived "hash_alg" is then dropped ("PublicKeyOrCertificate::PublicKey { ref key, .. }"). * The signature blob is decoded ("Signature::decode") and verified with "Verifier::verify(&pubkey, &buf, &sig)". "ssh-key" picks the hash from the signature's own algorithm ("sig.algorithm()"). * "pubkey_algo" and "sig.algorithm()" are never compared. So for an RSA key, the request can say "rsa-sha2-512" while the signature is "ssh-rsa". The signature is valid for SHA-1, verification succeeds, and "Handler::auth_publickey" is called. Affected versions: every russh release, from the first ("0.34.0-beta.1", 2022-03) through 0.63.3 and current "main". The behaviour is inherited from "thrussh", which russh was forked from. The mechanism changed over time, but the outcome is the same: the hash is always taken from the signature blob, never checked against the request. * Up to 0.46: after reading the algorithm name inside the signature blob, russh overwrites the key's hash with it ("pubkey.set_algorithm(algo_)"), then verifies. * From 0.47/0.48 (move to "ssh-key"): the signature is decoded with its own algorithm ("sig_workaround::Sig::decode", later "Signature::decode") and verified with it. Confirmed by running the PoC below on 0.63.3. Confirmed by reading the code of "server/encrypted.rs" in 0.34.0-beta.1, 0.34.0, 0.36.0, 0.36.1, 0.37.1, 0.40.2, 0.43.0, 0.45.0, 0.46.0, 0.48.2, 0.50.4, 0.54.6, 0.58.1, 0.63.1, 0.63.3 and "main" (2026-09-30), and in thrussh 0.33.5.