CVE-2026-102631: CWE-287 Improper Authentication in Canonical authd

In authd versions prior to 0.7.1, the UpdateUser function matches incoming logins first by broker-scoped provider ID, but if the provider ID is unknown, it falls back to matching by username without rejecting conflicting non-empty provider IDs. This flaw allows an identity provider to reassign an email address (used as the username) to a new account, causing the new account to inherit the previous user's local UID and home directory upon login. Consequently, the new user gains access to the previous user's files and credentials, including SSH keys and cloud API tokens, effectively rebinding the local account record to the new identity.

The vulnerability enables unauthorized access to local user files and sensitive credentials by allowing a new user to inherit the previous user's local UID and home directory. This can lead to unauthorized modification and access to SSH keys, cloud API tokens, and other sensitive data stored in the user's home directory. The impact is limited to local authentication and identity management within authd and requires local access vectors.

No official patch or fix is currently documented. Administrators should mitigate this vulnerability by locking or deleting the previous user's local authd account when the corresponding identity provider account is removed. This prevents the reassignment of local UIDs and home directories to new users. Monitor vendor advisories for any official fixes or updates.