USN-8957-1: authd vulnerability

Q: Who is at risk from this issue?

Systems using authd to match accounts from identity providers are at risk. The issue could allow an attacker to access another user's local account and files.

Q: What does an attacker need to exploit it?

The available information indicates the issue occurs during account matching from identity providers. It does not specify any additional privileges, authentication requirements, or network access prerequisites.

Q: What is the potential impact of successful exploitation?

An attacker may gain access to another user's local account and files, which can expose sensitive information.

Published Oct 27, 2026

Updated

Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.

Affected Software

3 affected componentsFixes available

ubuntu/authd

All of the following

ubuntu/authd<0.7.1

0.7.1

Ubuntu Ubuntu=26.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/authd to a version that resolves this vulnerability.
Fixed in 0.7.1

Event History

Oct 27, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-102631

Frequently Asked Questions

Who is at risk from this issue?

Systems using authd to match accounts from identity providers are at risk. The issue could allow an attacker to access another user's local account and files.

What does an attacker need to exploit it?

The available information indicates the issue occurs during account matching from identity providers. It does not specify any additional privileges, authentication requirements, or network access prerequisites.

What is the potential impact of successful exploitation?

An attacker may gain access to another user's local account and files, which can expose sensitive information.

USN-8957-1: authd vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is at risk from this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is at risk from this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?