Authenticated policy bypass via unchecked channel state

Incorrect authorization in Eugeny russh before 0.62.5 allows remote authenticated users to invoke callbacks without an open SSH channel. In server_read_authenticated, channel-scoped messages decode an attacker-chosen recipient ID and dispatch Handler callbacks without verifying that enc.channels contains a confirmed channel. Valid SSH credentials are required, and downstream impact depends on the server application; demonstrated effects include bypassing denied channel-open policy and executing protected exec_request actions.