Description

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T17:17:52.827Z",
  "pubdate": "2026-09-09T17:17:52.827Z",
  "executiveSummary": "This vulnerability involves an improper authentication bypass within the SSSD (System Security Services Daemon) IdP authentication provider. The flaw stems from the use of an insecure string comparison method when validating OpenID Connect (OIDC) subject identifiers.\nSpecifically, the application utilizes the strncmp() function to verify the user's identifier against the expected value. Because strncmp() performs a prefix-based comparison limited by the length of the attacker's provided identifier, an attacker can successfully authenticate as a target user if their own identifier serves as a strict prefix of the target user's identifier.\nThis represents a critical authentication bypass vulnerability. Successful exploitation allows an unauthorized actor to masquerade as another legitimate user within the environment, potentially gaining unauthorized access to resources, systems, or services restricted to the target account.\nThe vulnerability affects SSSD environments configured to use OIDC providers. Attackers require the ability to interact with the IdP authentication process and must possess an identifier that is a valid prefix of the target victim's identifier. The risk is significant, as it fundamentally undermines the identity verification mechanism of the authentication service.",
  "technicalDetails": "The root cause of this vulnerability is located in the eval_access_token_buf() function within the SSSD IdP authentication provider. The logic responsible for validating the identity of the authenticated user against the expected subject identifier uses the strncmp() C library function.\nIn standard security implementations, identity verification requires an exact string match (streq or strcmp) to ensure that the provided subject identifier is identical to the user's registered unique identifier. However, the implementation in eval_access_token_buf() utilizes strncmp(s1, s2, n), where 'n' is the length of the attacker's identifier. Because strncmp() terminates successfully as soon as it matches the specified 'n' characters, the function fails to verify that the subsequent characters in the user's identifier are null or absent.\nThe attack flow begins when an attacker, who holds a valid account on the IdP, constructs a malicious OIDC token. If the attacker's identifier is 'user' and the target victim's identifier is 'username', the attacker submits an authentication request. The eval_access_token_buf() function retrieves the target user's stored identifier and compares it against the attacker's identifier using the length of the attacker's identifier (4 bytes). Since the first four characters ('user') match the start of the victim's identifier ('username'), strncmp() returns 0, indicating a successful match.\nConsequently, the SSSD daemon grants the attacker the session of the victim. This logic error effectively ignores the remainder of the victim's identifier string, treating the attacker's short identifier as equivalent to the longer, victim-specific identifier. This bypass is possible without prior knowledge of the victim's credentials, provided the attacker can manipulate their own IdP identifier to form a prefix relationship with a target. This leads to a total compromise of the authentication context, enabling lateral movement and unauthorized privilege escalation within the scope of the victim's account permissions. No specific post-exploitation payload is required, as the bypass is inherent in the session establishment process, leading directly to authorized access."
}