CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

The SSSD IdP authentication provider was introduced in upstream sssd-2.11.0 (commit cf3a1d85). Red Hat Enterprise Linux 10.2 is the first and only RHEL version that ships the IdP provider feature. RHEL 10.1, despite shipping sssd-2.11, did not build the IdP provider component. All earlier RHEL versions (7, 8, 9) ship SSSD versions that predate the IdP provider and are therefore not affected.

Exploitation requires SSSD to be configured with id_provider = idp and auth_provider = idp using Keycloak with LDAP User Federation in "Import Users = false" mode (non-default). In this configuration, Keycloak uses username-derived identifiers as the OIDC sub claim rather than random UUIDs, which can produce prefix relationships between user identifiers (e.g., "admin" vs "administrator"). The attacker requires only an ordinary IdP user account whose identifier is a strict prefix of the target's — no administrative or privileged access is needed.

The default Keycloak LDAP federation mode (Import Users = true) assigns random UUIDs that prevent prefix collisions, substantially reducing exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Deployments not using the IdP authentication provider (idp_type = keycloak) are not affected. For affected deployments: (1) If using Keycloak LDAP federation, switching to Import Users: enabled mode causes Keycloak to assign random UUIDs as sub claims, making prefix collisions astronomically unlikely. (2) Restrict PAM login to specific users via simple_allow_users or access_provider = simple. (3) Disable Keycloak self-registration to prevent attackers from creating accounts with chosen prefix usernames.