Executive brief
SSSD is a system daemon that handles authentication for Linux systems using various identity providers, including OIDC/Keycloak. This vulnerability allows an attacker with a valid account whose username is a prefix of another user's username (e.g., "admin" vs "administrator") to authenticate as that target user. This breaks the security boundary between user accounts and can lead to unauthorized access, data theft, or privilege escalation depending on the compromised account's permissions.
Technical details
The vulnerability exists in SSSD's IdP authentication provider, specifically in the eval_access_token_buf() function, which uses strncmp() to compare OIDC subject identifiers. The function performs a prefix comparison using the authenticated user's identifier length instead of an exact string match (CWE-187). An attacker requires a valid OIDC user account whose identifier is a strict prefix of the target user's identifier, and SSSD must be configured with id_provider=idp and auth_provider=idp using Keycloak with LDAP User Federation in "Import Users = false" mode (non-default). Successful exploitation grants the attacker full access to the target user's account and systems. Patches are available from Red Hat and upstream SSSD maintainers.
Affected products
- Red Hat SSSD 2.11.0 and later
- Red Hat Red Hat Enterprise Linux 10.2
Timeline
- 2026-09-09: disclosed: CVE-2026-87853 published
- 2026-09-09: advisory: Red Hat security advisory issued