A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD… (CVE-2026-104033)

CVE-2026-104033 is a vulnerability in SSSD where, when configured to enforce account expiration via LDAP shadow attributes, an expiration value of zero is not recognized as expired. This allows users with valid credentials on these accounts to bypass access controls and authenticate to the system even after the account should have been deactivated. The flaw affects numerous explicitly listed versions of SSSD, primarily in Ubuntu distributions. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact.

Unauthorized access can persist beyond the intended account expiration, allowing users with valid credentials for expired accounts (with expiration value zero) to authenticate and bypass access controls. This undermines account deactivation policies and may lead to unauthorized system access.

No explicit patch or remediation status is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, administrators should review account expiration configurations and consider additional access controls or monitoring for accounts with expiration value zero.