diff --git a/openssh-10.4p1-CVE-2026-59999.patch b/openssh-10.4p1-CVE-2026-59999.patch
index 67b203e..b1bf58c 100644
--- a/openssh-10.4p1-CVE-2026-59999.patch
+++ b/openssh-10.4p1-CVE-2026-59999.patch
@@ -1,5 +1,69 @@
+diff --git a/auth-options.c b/auth-options.c
+index e15f600ab..c5fc4e59c 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
+ 	ret->permit_x11_forwarding_flag = 1;
+ 	ret->permit_pty_flag = 1;
+ 	ret->permit_user_rc = 1;
++	ret->permit_tun_flag = 1;
+ 	return ret;
+ }
+
+@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
+ 			ret->permit_x11_forwarding_flag = 0;
+ 			ret->permit_pty_flag = 0;
+ 			ret->permit_user_rc = 0;
++			ret->permit_tun_flag = 0;
+ 		} else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
+ 			ret->cert_authority = r;
+ 		} else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
+@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
+ 	OPTFLAG_AND(permit_x11_forwarding_flag);
+ 	OPTFLAG_AND(permit_pty_flag);
+ 	OPTFLAG_AND(permit_user_rc);
++	OPTFLAG_AND(permit_tun_flag);
+ 	OPTFLAG_AND(no_require_user_presence);
+ 	/* Restrictive flags are logical-OR (i.e. must be set in either) */
+ 	OPTFLAG_OR(require_verify);
+@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
+ 	OPTSCALAR(permit_x11_forwarding_flag);
+ 	OPTSCALAR(permit_pty_flag);
+ 	OPTSCALAR(permit_user_rc);
++	OPTSCALAR(permit_tun_flag);
+ 	OPTSCALAR(restricted);
+ 	OPTSCALAR(cert_authority);
+ 	OPTSCALAR(force_tun_device);
+@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
+ 	    (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
++	    (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
+@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
+ 	OPT_FLAG(permit_x11_forwarding_flag);
+ 	OPT_FLAG(permit_pty_flag);
+ 	OPT_FLAG(permit_user_rc);
++	OPT_FLAG(permit_tun_flag);
+ 	OPT_FLAG(restricted);
+ 	OPT_FLAG(cert_authority);
+ 	OPT_FLAG(no_require_user_presence);
+diff --git a/auth-options.h b/auth-options.h
+index 6e29b727c..191b9b249 100644
+--- a/auth-options.h
++++ b/auth-options.h
+@@ -39,6 +39,7 @@ struct sshauthopt {
+ 	int permit_x11_forwarding_flag;
+ 	int permit_pty_flag;
+ 	int permit_user_rc;
++	int permit_tun_flag;
+
+ 	/* "restrict" keyword was invoked */
+ 	int restricted;
 diff --git a/serverloop.c b/serverloop.c
-index 8a6e3db80..9d8a3429e 100644
+index 8a6e3db80..cf5243f80 100644
 --- a/serverloop.c
 +++ b/serverloop.c
 @@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
@@ -8,7 +72,7 @@ index 8a6e3db80..9d8a3429e 100644
  	}
 -	if ((options.permit_tun & mode) == 0) {
 +	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
-+	    auth_opts->restricted) {
++	    !auth_opts->permit_tun_flag) {
  		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
  		    "forwarding");
  		return NULL;
diff --git a/openssh.spec b/openssh.spec
index 5447cbf..850eb04 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -47,7 +47,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 9.9p1
-%global openssh_rel 12
+%global openssh_rel 13
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 10
 
@@ -274,6 +274,7 @@ Patch1049: openssh-10.4p1-CVE-2026-59995.patch
 # upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
 # upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
 # combines CVE-2026-59999 and CVE-2026-73283
+# downstream specific fix, drop on rebase
 Patch1050: openssh-10.4p1-CVE-2026-59999.patch
 
 
@@ -790,6 +791,11 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Fri Aug 21 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-13
+- CVE-2026-73283: Complete the fix of security bypass due to incorrect
+  handling of forwarding and tunneling options
+  Resolves: RHEL-245414
+
 * Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
   file location