Critical vulnerability in Cockpit's remote login feature allows command injection through unsanitized hostnames and usernames. Attackers with network access can exploit this via a single HTTP request to achieve code execution without valid credentials. The injection occurs during authentication flow before credential verification, making it exploitable without authentication. The vulnerability affects the SSH client integration in Cockpit's web interface.