I have a firewall in place between the Cyberduck client and the SSH server I want to connect to. The firewall intercepts the SSH connection and requires an additional authentication step.

So I connect to the firewall and Cyberduck asks me for the first password (for the firewall). At this stage only the "password" authentication scheme is supported. When I enter the correct password Cyberduck says "partial authentication success" and asks me for the second (server) password. Now the "password" and "keyboard-interactive" schemes are supported.

Regardless of what I enter as the second password, Cyberduck always sends the first password again. The SSH server rejects it, Cyberduck once again asks for a password and finally transmits it correctly.