CVE-2026-87853

SSSD's IdP authentication provider, which lets Linux systems authenticate users against OpenID Connect (OIDC) identity providers, contains a partial-comparison flaw (CWE-187): the eval_access_token_buf() function uses strncmp() bounded by the authenticated user's identifier length, so the OIDC subject identifier is accepted on a prefix match instead of an exact match. An attacker who holds an account at the connected IdP whose subject identifier is a strict prefix of a target user's identifier (for example 'alice' versus 'alice.smith') can complete authentication and be treated as the target user, gaining that user's access on the host, with high confidentiality and integrity impact. Any Linux deployment running a vulnerable SSSD build with the IdP (OIDC) provider configured is affected; the CNA is Red Hat, so enterprise RHEL estates using OIDC-based sign-in are the primary concern. No public proof-of-concept, inclusion in CISA KEV, or known in-the-wild exploitation has been reported as of this analysis.

What to do: Patch SSSD via your distribution's security errata (watch for the Red Hat advisory, as no fixed version is stated in the available data). Until patched, audit the IdP subject identifiers configured on your IdP for prefix relationships between accounts and enforce uniqueness, or disable the IdP (OIDC) authentication provider on hosts that do not need it. Check your sssd.conf to determine whether hosts use the IdP provider at all, since SSSD deployments using LDAP/AD/FreeIPA providers are not exposed through this code path.