# CVE-2026-87853: SSSD IdP authentication prefix comparison authentication bypass

Source: https://junglewise.ai/threats/cve-2026-87853-sssd-idp-authentication-prefix-comparison-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87853 · Severity: high · CVSS 7.5 · Published 2026-09-09

SSSD is a system daemon that handles authentication for Linux systems using various identity providers, including OIDC/Keycloak. This vulnerability allows an attacker with a valid account whose username is a prefix of another user's username (e.g., "admin" vs "administrator") to authenticate as that target user. This breaks the security boundary between user accounts and can lead to unauthorized access, data theft, or privilege escalation depending on the compromised account's permissions.

Technologies: [Red Hat Enterprise Linux](https://junglewise.ai/threats/technologies/red-hat-enterprise-linux). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-87853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87853 being exploited in the wild.

**How severe is CVE-2026-87853?** High severity, with a CVSS score of 7.5, published 9 September 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux 10.2.

**Is there a fix for CVE-2026-87853?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87853 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-87853?** Check whether you run Red Hat Enterprise Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in SSSD's IdP authentication provider, specifically in the eval_access_token_buf() function, which uses strncmp() to compare OIDC subject identifiers. The function performs a prefix comparison using the authenticated user's identifier length instead of an exact string match (CWE-187). An attacker requires a valid OIDC user account whose identifier is a strict prefix of the target user's identifier, and SSSD must be configured with id_provider=idp and auth_provider=idp using Keycloak with LDAP User Federation in "Import Users = false" mode (non-default). Successful exploitation grants the attacker full access to the target user's account and systems. Patches are available from Red Hat and upstream SSSD maintainers.

## Affected products

- Red Hat SSSD 2.11.0 and later
- Red Hat Red Hat Enterprise Linux 10.2

## Timeline

- 2026-09-09: disclosed: CVE-2026-87853 published
- 2026-09-09: advisory: Red Hat security advisory issued

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-87853](https://access.redhat.com/security/cve/CVE-2026-87853)

## Related threats

- [Red Hat Enterprise Linux kernel local_bh imbalance in seg6_input_core](https://junglewise.ai/threats/cve-2026-118593-a-flaw-was-found-in-red-hat-enterprise-linux-9-kernel-builds-an)
- [Red Hat ansible-core path traversal in collection install](https://junglewise.ai/threats/cve-2026-89091-a-flaw-was-found-in-ansible-core-when-installing-a-collection)
- [Red Hat leapp-repository privilege escalation in scan_mysql](https://junglewise.ai/threats/cve-2026-75092-red-hat-leapp-repository-privilege-escalation-in-scan-mysql)
- [PCS arbitrary file read via pcs host auth --token](https://junglewise.ai/threats/cve-2026-84828-pcs-arbitrary-file-read-via-pcs-host-auth-token)
- [Linux Kernel buffer overflow in IPv6 paged allocation](https://junglewise.ai/threats/cve-2026-53362-linux-kernel-buffer-overflow-in-ipv6-paged-allocation)