CVE-2026-87853 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

High 7.5 Published 9 Sep 2026 Updated 29 Oct 2026

Attackers can impersonate other users by exploiting a prefix comparison flaw in SSSD's OIDC authentication, leading to unauthorized access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-87853?

CVE-2026-87853 is a high-severity authentication bypass vulnerability in Red Hat Enterprise Linux 10, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

Weakness: CWE-187

Which versions are affected by CVE-2026-87853?

Linux distribution packages (40)

`libipa_hbac` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_autofs` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_certmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_idmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_nss_idmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_nss_idmap-devel` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libsss_sudo` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`python3-libipa_hbac` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`python3-libsss_nss_idmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`python3-sss` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`python3-sss-murmur` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`python3-sssdconfig` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-ad` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-client` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-common` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-common-pac` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-dbus` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-idp` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-ipa` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-kcm` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-krb5` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-krb5-common` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-ldap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-nfs-idmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-passkey` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-proxy` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-tools` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`sssd-winbind-idmap` AlmaLinux:10	All versions	`2.12.0-3.el10_2.2`
`libipa_hbac` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libipa_hbac-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_autofs` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_autofs-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_certmap` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_certmap-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_idmap` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_idmap-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_nss_idmap` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_nss_idmap-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`
`libsss_nss_idmap-devel` Red Hat:enterprise_linux:10.2	All versions	`0:2.12.0-3.el10_2.2`

How do I fix CVE-2026-87853?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-87853 being exploited?

There is no known exploitation of CVE-2026-87853 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:77534, DEBIAN-CVE-2026-87853, GHSA-993g-jgf7-rg3x, RHSA-2026:77534, RLSA-2026:77534, UBUNTU-CVE-2026-87853 and 1 more.