Количество 5
Количество 5
CVE-2026-87853
(A flaw was found in SSSD's IdP authentication provider. The eval_acces ...)
CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The eval_acces ...
GHSA-993g-jgf7-rg3x
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-87853 (A flaw was found in SSSD's IdP authentication provider. The eval_acces ...) | CVSS3: 7.5 | 0% Низкий | 5 дней назад |
 | CVE-2026-87853 A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user. | CVSS3: 7.5 | 0% Низкий | 7 дней назад |
 | CVE-2026-87853 A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user. | CVSS3: 7.5 | 0% Низкий | 7 дней назад |
| CVE-2026-87853 A flaw was found in SSSD's IdP authentication provider. The eval_acces ... | CVSS3: 7.5 | 0% Низкий | 7 дней назад |
| GHSA-993g-jgf7-rg3x A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user. | CVSS3: 7.5 | 0% Низкий | 6 дней назад |
Уязвимостей на страницу