CVE-2026-87853
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-187: Partial String Comparison
Workarounds
Deployments not using the IdP authentication provider (idp_type = keycloak) are not affected. For affected deployments: (1) If using Keycloak LDAP federation, switching to Import Users: enabled mode causes Keycloak to assign random UUIDs as sub claims, making prefix collisions astronomically unlikely. (2) Restrict PAM login to specific users via simple_allow_users or access_provider = simple. (3) Disable Keycloak self-registration to prevent attackers from creating accounts with chosen prefix usernames.
References
- https://access.redhat.com/security/cve/CVE-2026-87853
- https://bugzilla.redhat.com/show_bug.cgi?id=2530888
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.