A flaw was found in SSSD's IdP authentication provider. (CVE-2026-87853)

CVE-2026-87853 is a vulnerability in the System Security Services Daemon (SSSD) IdP authentication provider. The flaw arises because the eval_access_token_buf() function compares the OpenID Connect (OIDC) subject identifier using strncmp() with the length of the authenticated user's identifier, resulting in a prefix comparison rather than an exact match. Consequently, an attacker whose IdP identifier is a strict prefix of a legitimate user's identifier can bypass authentication and impersonate that user. This affects numerous specific versions of SSSD as listed. The vulnerability has a CVSS 3.1 base score of 7.5, with network attack vector, high impact on confidentiality, integrity, and availability, and requires low privileges and high attack complexity.

An attacker can authenticate as another user if their IdP identifier is a strict prefix of the target user's identifier. This leads to unauthorized access with the privileges of the impersonated user, impacting confidentiality, integrity, and availability of the system. The vulnerability requires network access and low privileges but has a high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should monitor for updates from the SSSD maintainers or their Linux distribution vendors. No vendor advisory or patch links are provided in the current data, so no specific remediation steps can be recommended beyond awaiting an official fix.