CVE-2026-127100: Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder
A flaw was found in SSSD. The jsonunpackoauth2code() function in src/responder/pam/pamsrvjson.c fails to validate that the OAuth2 JSON code field has string type. A present non-string value causes jsonstringvalue() to return NULL. The function can return success with a NULL output, after which jsonunpackauthreply() evaluates strlen(oauth2code), causing a NULL pointer dereference and terminating sssdpam. A local user able to connect to the PAM responder socket can provide crafted JSON authentication information and selection items before authentication. The affected code is conditional on HAVEGDMCUSTOMJSONPAMEXTENSION. The maintainer confirmed that the extension is enabled beginning with RHEL 9.8 and RHEL 10.2, and that the incoming selection data is not sanitized at the socket boundary. Exact affected builds and backports still require product assessment. Source report: PSIRTSUPT-25890, finding H-08. Related earlier record: OSIM-80264 / 559edf59-4ee2-49f9-95cd-d5d36b419a81; it was automatically rejected because no CVE was assigned, rather than on a technical invalidity determination.
Other sources
A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.
— MITRE