CVE-2026-104033: Off-by-one Error in Red Hat Red Hat Enterprise Linux 10

This vulnerability affects the System Security Services Daemon (SSSD) in Red Hat Enterprise Linux 10 when configured to enforce account expiration using LDAP shadow attributes. Due to an off-by-one error, an expiration value of zero is not recognized as an expired account, allowing a user with valid credentials for such an account to bypass access controls and authenticate to the system. This results in unauthorized access persisting beyond intended account deactivation.

The flaw allows unauthorized access by permitting authentication of accounts that should be expired, potentially enabling continued access by users who should no longer have system access. The impact is limited to confidentiality and integrity with no reported availability impact. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104033 for current remediation guidance. Until a patch is applied, administrators should review account expiration configurations and consider additional access controls or monitoring to mitigate unauthorized access risks.