Ubuntu authd flaw may expose another user’s local account
Original title: USN-8957-1: authd vulnerability
USN-8957-1 says identity-provider account matching can be abused for unauthorized access to files.
Ubuntu security notice USN-8957-1 says Ali Mashally found that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly reach another user’s local account and files. The notice snippet gives no affected versions, fix, or CVE.
Unconfirmed: The snippet does not say whether the issue is exploited or which releases are affected.
- The issue is improper validation when matching identity-provider accounts.
- Impact described is unauthorized access to another user’s files.
- No fixed version or CVE appears in the notice snippet.
Impact: Access to another user’s local account and files
| Product | Affected |
|---|---|
| Ubuntu authd | — |
From the original article
Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.