CVE-2026-87853

Name	CVE-2026-87853
Description	A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1147731

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sssd (PTS)	bookworm	2.8.2-4+deb12u1	vulnerable
	trixie	2.10.1-2	vulnerable
	sid	2.13.1-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
sssd	source	(unstable)	(unfixed)			1147731

Notes

[trixie] - sssd <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2530888
https://github.com/SSSD/sssd/pull/9250
Fixed by: https://github.com/SSSD/sssd/commit/f3a324918c1a35bd0195a1de5b17897a0d3b6274 (master)
Fixed by: https://github.com/SSSD/sssd/commit/8180e70a2708dbf8ac6f089119922dec81fcc503 (sssd-2-13)
Fixed by: https://github.com/SSSD/sssd/commit/542411bb0b6e4171d9183fbf364d6cb52d848ad5 (sssd-2-12)