CVE-2026-92821: Return of Wrong Status Code in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in SSSD's handling of password expiration warnings when configured to evaluate these warnings before restrictive access rules in LDAP environments. Specifically, if a user's password is expired, the warning causes early termination of access rule evaluation, resulting in the access request being treated as successful. This allows a remote authenticated user with an expired password, authenticating through alternative methods such as SSH public key authentication, to bypass access control restrictions and gain unauthorized access to protected systems running Red Hat Enterprise Linux 10.

An attacker with a valid account but an expired password can bypass LDAP access control restrictions by exploiting the early termination of rule evaluation caused by the expired-password warning. This leads to unauthorized access to protected systems, potentially compromising confidentiality and integrity. The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, high impact on confidentiality and integrity, but requiring low privileges and high attack complexity.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-92821 for current remediation guidance. Until an official fix is available, consider reviewing SSSD configuration to avoid evaluating password expiration warnings before restrictive LDAP access rules or restrict alternative authentication methods for users with expired passwords.