GatewayPorts option can be incorrectly activated during dynamic port forwarding if no external interface is specified. If GSSAPIDelegateCredentials option is activated user who used different logon type can be delegated with GSSAPI credentials.
vulners.com/securityvulns/securityvulns:doc:9645