Other way around. This requires a passwordless account configured with sha256 or sha512 password hash, musl system with openssh installed, no PAM, and password authentication allowed:

When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.