CVE-2026-87853 — Vulnerability intelligence
—
Published:
- CVSS
- 7.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.