What’s Vulnerable › Vulnerabilities

CVE-2026-87853: Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-10-29
• Weakness: CWE-187

Description

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

Affected products

• Red Hat Enterprise Linux 10: all versions — fixed in 0:2.12.0-3.el10_2.2

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:2.12.0-3.el10_2.2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:77534
• https://access.redhat.com/security/cve/CVE-2026-87853
• https://bugzilla.redhat.com/show_bug.cgi?id=2530888

Get alerted when CVE-2026-87853 or the next vulnerability affects your stack