Quick answers
- Is CVE-2026-102631 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102631 being exploited in the wild.
- How severe is CVE-2026-102631?
- Informational severity, published 15 October 2026.
- Which products and versions are affected?
- Canonical Authd before 0.7.1.
- Is there a fix for CVE-2026-102631?
- Yes: fixed in authd 0.7.1. Until then: Administrators should lock or delete local authd accounts when the corresponding IdP account is removed to prevent reuse by new users assigned the same email address. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-102631 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-102631?
- Check whether you run Canonical Authd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: authd 0.7.1
Administrators should lock or delete local authd accounts when the corresponding IdP account is removed to prevent reuse by new users assigned the same email address.
Technical details
The UpdateUser function in internal/users/manager.go matches incoming logins by provider ID but falls back to username (typically email) when the provider ID is unknown. If a new identity has a different provider ID but the same username as a deleted or inactive user, the function fails to reject the conflict and reuses the existing local UID and home directory. An attacker requires access to an identity provider that assigns an email address previously used at the target organization to a new account they control, plus the previous local account to remain unlocked.
Affected products
- Canonical authd before 0.7.1
Timeline
- 2026-09-25: disclosed
- 2026-10-15: advisory
- 2026-10-15: patched