High [CVE-2026-87853] IdP authentication prefix comparison allows cross-user impersonation
This high-severity Red Hat Linux advisory covers CVE-2026-87853 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat package: sssd.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match.
An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user. Red Hat Enterprise Linux 10.2 is the first and only RHEL version that ships the IdP provider feature.
Exploitation requires SSSD to be configured with id_provider = idp and auth_provider = idp using Keycloak with LDAP User Federation in "Import Users = false" mode (non-default).
In this configuration, Keycloak uses username-derived identifiers as the OIDC sub claim rather than random UUIDs, which can produce prefix relationships between user identifiers (e.g., "admin" vs "administrator").
The default Keycloak LDAP federation mode (Import Users = true) assigns random UUIDs that prevent prefix collisions, substantially reducing exposure. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-187. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6.
Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: sssd.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Deployments not using the IdP authentication provider (idp_type = keycloak) are not affected. For affected deployments: (1) If using Keycloak LDAP federation, switching to Import Users: enabled mode causes Keycloak to assign random UUIDs as sub claims, making prefix collisions astronomically unlikely. (2) Restrict PAM login to specific users via simple_allow_users or access_provider = simple. (3) Disable Keycloak self-registration to prevent attackers from creating accounts with chosen prefix usernames.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.