Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-87853

Fixed in a distro release EPSS <1%CVSS 7.5

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

Published 2026-09-09 · CVE record · OSV

Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4

Distro releases

ReleasePackageFixed in
AlmaLinux 10libipa_hbac2.12.0-3.el10_2.2
AlmaLinux 10libsss_autofs2.12.0-3.el10_2.2
AlmaLinux 10libsss_certmap2.12.0-3.el10_2.2
AlmaLinux 10libsss_idmap2.12.0-3.el10_2.2
AlmaLinux 10libsss_nss_idmap2.12.0-3.el10_2.2
AlmaLinux 10libsss_nss_idmap-devel2.12.0-3.el10_2.2
AlmaLinux 10libsss_sudo2.12.0-3.el10_2.2
AlmaLinux 10python3-libipa_hbac2.12.0-3.el10_2.2
AlmaLinux 10python3-libsss_nss_idmap2.12.0-3.el10_2.2
AlmaLinux 10python3-sss2.12.0-3.el10_2.2
AlmaLinux 10python3-sss-murmur2.12.0-3.el10_2.2
AlmaLinux 10python3-sssdconfig2.12.0-3.el10_2.2
AlmaLinux 10sssd2.12.0-3.el10_2.2
AlmaLinux 10sssd-ad2.12.0-3.el10_2.2
AlmaLinux 10sssd-client2.12.0-3.el10_2.2
AlmaLinux 10sssd-common2.12.0-3.el10_2.2
AlmaLinux 10sssd-common-pac2.12.0-3.el10_2.2
AlmaLinux 10sssd-dbus2.12.0-3.el10_2.2
AlmaLinux 10sssd-idp2.12.0-3.el10_2.2
AlmaLinux 10sssd-ipa2.12.0-3.el10_2.2
AlmaLinux 10sssd-kcm2.12.0-3.el10_2.2
AlmaLinux 10sssd-krb52.12.0-3.el10_2.2
AlmaLinux 10sssd-krb5-common2.12.0-3.el10_2.2
AlmaLinux 10sssd-ldap2.12.0-3.el10_2.2
AlmaLinux 10sssd-nfs-idmap2.12.0-3.el10_2.2
AlmaLinux 10sssd-passkey2.12.0-3.el10_2.2
AlmaLinux 10sssd-proxy2.12.0-3.el10_2.2
AlmaLinux 10sssd-tools2.12.0-3.el10_2.2
AlmaLinux 10sssd-winbind-idmap2.12.0-3.el10_2.2
Debian 12sssdno fix
Debian 13sssdno fix
Red Hat Enterprise Linux 10.2libipa_hbac0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libipa_hbac-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_autofs0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_autofs-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_certmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_certmap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_idmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_idmap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_nss_idmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_nss_idmap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_nss_idmap-devel0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_sudo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2libsss_sudo-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-libipa_hbac0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-libipa_hbac-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-libsss_nss_idmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-libsss_nss_idmap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-sss0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-sss-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-sss-murmur0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-sss-murmur-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2python3-sssdconfig0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ad0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ad-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-client0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-client-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-common0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-common-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-common-pac0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-common-pac-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-dbus0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-dbus-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-debugsource0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-idp0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-idp-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ipa0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ipa-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-kcm0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-kcm-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-krb50:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-krb5-common0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-krb5-common-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-krb5-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ldap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-ldap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-nfs-idmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-nfs-idmap-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-passkey0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-passkey-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-proxy0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-proxy-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-tools0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-tools-debuginfo0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-winbind-idmap0:2.12.0-3.el10_2.2
Red Hat Enterprise Linux 10.2sssd-winbind-idmap-debuginfo0:2.12.0-3.el10_2.2
Rocky Linux 10sssd0:2.12.0-3.el10_2.2
Ubuntu 22.04 LTSsssdno fix
Ubuntu 24.04 LTSsssdno fix
Ubuntu 26.04 LTSsssdno fix
Ubuntu 26.10sssdno fix
Ubuntu Pro 16.04 LTSsssdno fix
Ubuntu Pro 18.04 LTSsssdno fix
Ubuntu Pro 20.04 LTSsssdno fix
openSUSE Tumbleweedsssd2.13.1-3.1