CVE-2025-5689: Canonical Authd Auth Bypass Vulnerability

CVE-2025-5689 Overview

CVE-2025-5689 affects Canonical authd, an authentication daemon used on Ubuntu systems to broker logins through cloud identity providers. The vulnerability resides in the temporary user record that authd creates within its pre-authentication Name Service Switch (NSS) module. When a user logs in for the first time over SSH, the temporary record incorrectly associates the session with the root group. An authenticated attacker with low privileges can leverage this group membership to access resources restricted to root group members. The flaw is classified under [CWE-269: Improper Privilege Management].

Critical Impact
First-time SSH logins inherit root group membership, granting unauthorized access to root-group-owned files and resources within the session context.

Affected Products

Canonical authd (Ubuntu authentication daemon)
Systems using authd pre-auth NSS module for SSH authentication
Ubuntu deployments integrating authd with cloud identity providers

Discovery Timeline

2025-06-16 - CVE-2025-5689 published to the National Vulnerability Database
2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-5689

Vulnerability Analysis

The authd daemon provides authentication services on Ubuntu hosts by integrating external identity providers with the local NSS subsystem. To support users who have never logged in before, authd constructs a temporary user record through its pre-auth NSS module. This record supplies the necessary user identity attributes during the SSH authentication handshake.

The defect lies in how the temporary record populates supplementary group membership. Instead of assigning a neutral or unprivileged group, the record lists the user as a member of the root group (GID 0). When SSH establishes the session, the kernel honors the supplementary group, and any process spawned during that session inherits root group credentials.

This behavior breaks the principle of least privilege. A user authenticating for the first time gains read or write access to any file or socket whose group is root, even though the user is not an administrator.

Root Cause

The root cause is improper privilege management in the temporary user record generation logic of the pre-auth NSS module. The code path that builds the placeholder identity does not strip or sanitize default group entries, resulting in root group inclusion. The condition triggers only on the first login because subsequent logins use a persisted record built through the standard provisioning flow.

Attack Vector

An attacker who controls a valid identity in the configured identity provider can initiate an SSH connection to a target host running vulnerable authd. The attack requires that the user has not previously authenticated on the target system. After successful authentication, the resulting session runs with root group supplementary credentials, allowing the attacker to interact with files and resources gated by group root permissions. Refer to the GitHub Security Advisory GHSA-g8qw-mgjx-rwjr for technical specifics.

Detection Methods for CVE-2025-5689

Indicators of Compromise

First-time SSH login events on hosts running authd followed by access to files owned by group root
Process accounting records showing non-administrative users executing commands with root group supplementary credentials
Unexpected id or groups output during initial sessions listing GID 0 for standard users

Detection Strategies

Audit SSH session establishment using auditd rules that capture setgroups and initgroups syscalls for new sessions
Correlate authd log entries for pre-auth NSS lookups with subsequent file access events touching root-group-owned paths
Compare effective supplementary groups against the identity provider's authoritative group mapping for each user

Monitoring Recommendations

Enable verbose logging in authd to capture pre-auth NSS record contents during first-login flows
Forward SSH and PAM authentication logs to a central log analytics platform for anomaly review
Alert on any non-root user session that lists root in the output of id -G

How to Mitigate CVE-2025-5689

Immediate Actions Required

Upgrade authd to the patched release referenced in the GitHub Security Advisory GHSA-g8qw-mgjx-rwjr
Audit existing user sessions and revoke any unauthorized access granted to root-group-owned resources
Restrict SSH access to vetted identity provider accounts until the patch is applied

Patch Information

Canonical published a fixed version of authd through the project's GitHub Security Advisory. Administrators should apply the update from the Ubuntu archive or rebuild from the patched source referenced in the advisory. Verify the installed version after upgrade and restart the authd service to ensure the corrected NSS module is loaded.

Workarounds

Pre-provision user accounts through an out-of-band channel so first-login pre-auth NSS records are not generated on the target host
Disable the pre-auth NSS path in authd configuration where supported, requiring users to authenticate through a previously cached record
Remove root group from any non-essential resources to limit the blast radius until patching completes

bash

# Verify installed authd version and group membership after login
dpkg -l | grep authd
id -Gn <username>
# Restart authd after applying the upgrade
sudo systemctl restart authd