CVE-2026-54590: asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

The fix for CVE-2026-45309 added a guard in SSHServerConfig._set_tokens (asyncssh/config.py:715-716) that rejects an SSH username containing /, \, or equal to .., before it is substituted for the %u token in AuthorizedKeysFile:

if self._user == ‘..’ or ‘/’ in self._user or ‘\’ in self._user: raise IllegalUserName(‘Unsafe username substitution’)

However, the %u-substituted value is subsequently passed through environment-variable expansion (_expand_val, config.py:145-149 — token expansion then env expansion) and, at file-open time, through expanduser() (read_authorized_keys → read_file → open(Path(filename).expanduser()), auth_keys.py:348 → misc.py:290). Both re-introduce the path control the guard was meant to remove, so a username that contains no //\ can still cause the server to read an authorized-keys file outside the intended per-user directory.

The client-supplied username reaches this path pre-authentication: _process_userauth_request takes the username from the SSH_MSG_USERAUTH_REQUEST packet (connection.py:2516-2519) and _finish_userauth calls reload_config() (connection.py:2536), which re-evaluates AuthorizedKeysFile with username=self._username (connection.py:5906) before the offered key is validated.