chameleon

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can’t have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine’s announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

That looks correct to me if uid 1101 == userC. Sorry, don’t really know what it might be then.

Complete shot in the dark, but I would start by comparing podman system info between the two user accounts, with the most importance on the idMappings. Podman is usually configured to use rootless by default, and this can result in wildly different behavior based on whether /etc/subuid and /etc/subgid are configured to give your user IDs or not. See tutorial if your user 1001 is missing.

Modern distro installers tend to give the user created during setup 65536 IDs, but useradd usually doesn’t do that by default. This is really distro-specific stuff though and I don’t know how modern Fedora handles it, so I might be grasping at nothing here.