CVE-2026-87853: SSSD IdP Auth Bypass Vulnerability

CVE-2026-87853 Overview

A flaw in the System Security Services Daemon (SSSD) Identity Provider (IdP) authentication provider allows attackers to authenticate as unintended users. The eval_access_token_buf() function compares the OpenID Connect (OIDC) subject identifier using strncmp() bounded by the authenticated user's identifier length. This produces a prefix comparison rather than an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as that target user. The weakness is classified as [CWE-187] Partial String Comparison.

Critical Impact
An authenticated user whose OIDC subject identifier is a prefix of a higher-privileged user's identifier can impersonate that user, breaking authentication integrity across systems relying on SSSD IdP.

Affected Products

SSSD (System Security Services Daemon) IdP authentication provider
Red Hat distributions shipping the affected SSSD component
Linux systems configured with OIDC-based IdP authentication via SSSD

Discovery Timeline

2026-09-09 - CVE-2026-87853 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87853

Vulnerability Analysis

SSSD acts as a client-side authentication broker on Linux systems, integrating local services with remote identity providers. Its IdP provider validates OIDC access tokens and maps the token's subject (sub) claim to a local user. The eval_access_token_buf() routine performs that comparison to decide whether the token bearer matches the requesting user.

The function uses strncmp() with a length derived from the authenticated user's identifier. When the two strings share a common prefix and the shorter identifier equals the compared length, strncmp() returns zero. SSSD then treats the identifiers as equivalent and grants access under the wrong identity.

The flaw sits in the authentication decision path, so successful exploitation produces no memory corruption or crash. The result is silent identity confusion that downstream authorization checks cannot detect.

Root Cause

The root cause is improper string comparison, tracked as [CWE-187]. strncmp() compares only the first n bytes and does not verify that both strings terminate at that boundary. Correct behavior requires either strcmp() for null-terminated identifiers or an explicit length equality check before invoking a bounded comparison. Because the length passed to strncmp() is taken from the authenticated user's identifier rather than the maximum of both, any identifier that is a strict prefix of the target satisfies the check.

Attack Vector

Exploitation requires an attacker to control an IdP account whose sub claim value is a strict prefix of the target user's sub claim. The attacker authenticates to the IdP normally, obtains a valid OIDC access token, and presents it to a service that relies on SSSD for IdP-backed authentication. SSSD then binds the token to the target user account. The high attack complexity reflects the requirement that the attacker either provision a controlled identifier that matches this prefix relationship or discover a naturally occurring one.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-87853 Advisory and Red Hat Bugzilla Entry #2530888 for upstream technical details.

Detection Methods for CVE-2026-87853

Indicators of Compromise

Successful SSSD authentications where the presented OIDC sub claim length differs from the resolved local user's mapped identifier length.
PAM authentication events referencing IdP tokens followed by privileged actions inconsistent with the token subject's normal activity.
Unexpected session establishment for accounts that did not initiate an interactive login flow with the IdP.

Detection Strategies

Parse /var/log/sssd/sssd_*.log for eval_access_token_buf entries and correlate the compared subject identifiers with the resolved user principal.
Alert on IdP token subjects that are prefixes of other known subjects within the same tenant or realm.
Compare IdP-issued subject claims against SSSD-resolved usernames and flag mismatches in length or terminating characters.

Monitoring Recommendations

Enable SSSD debug level 6 or higher on affected hosts during triage to capture subject comparison decisions.
Forward SSSD, PAM, and audit logs to a centralized SIEM for cross-host correlation of anomalous authentications.
Baseline expected IdP subject identifier formats and lengths per environment, then alert on deviations.

How to Mitigate CVE-2026-87853

Immediate Actions Required

Apply vendor-supplied SSSD updates as soon as they are published; track fixes via the Red Hat CVE-2026-87853 Advisory.
Audit existing IdP user identifiers for prefix collisions and rename or reissue conflicting subjects before patching completes.
Restrict which services on the host permit SSSD IdP authentication until the fix is deployed.

Patch Information

Red Hat is tracking the fix through Bugzilla #2530888. Consult distribution security advisories for the specific SSSD package version containing the corrected identifier comparison. The upstream fix replaces the bounded prefix comparison with an exact-match check on the OIDC subject identifier.

Workarounds

Enforce IdP-side policy that prevents provisioning subject identifiers whose values are prefixes of any other active identifier.
Where feasible, disable the SSSD IdP authentication provider and fall back to LDAP or Kerberos-backed authentication until the patch is applied.
Add PAM account-phase checks that reject sessions when the token subject length does not equal the resolved user identifier length.

bash

# Configuration example: temporarily disable IdP auth in sssd.conf
# /etc/sssd/sssd.conf
[domain/example.com]
auth_provider = ldap
# auth_provider = idp   # disabled pending CVE-2026-87853 patch
access_provider = ldap