CVE-2026-87853: Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
Other sources
A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf() function in src/providers/idp/idpautheval.c compares the authenticated user's OIDC subject identifier against the requested user's stored SYSDBUUID using strncmp() with the authenticated identifier's length as the count. This performs a prefix comparison rather than an exact match. An attacker whose complete IdP identifier is a strict prefix of a target user's identifier can authenticate as the target, gaining full access to the target's account, files, groups, and local authorization. With Keycloak's built-in LDAP provider (Import Users disabled), the identifier format f:<federationid>:<username> naturally produces prefix relationships for usernames like 'admin' and 'administrator'. No victim credential, interaction, or administrative role is required.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Systems using SSSD's IdP authentication provider are exposed when one user's OIDC subject identifier is a strict prefix of another user's identifier. Keycloak deployments using the built-in LDAP provider with Import Users disabled can naturally create this condition for usernames such as "admin" and "administrator".
What does an attacker need to exploit the flaw?
The attacker needs a valid IdP identity whose complete identifier is a strict prefix of the target user's identifier, and the ability to authenticate through the affected SSSD IdP provider. No victim credentials or user interaction are required.
What access can successful exploitation provide?
A successful attacker can authenticate as the target user and gain that account's access, including its files, groups, and local authorization.