CVE-2026-102631

Deferred Deferred - Pending Action

authd Session Hijacking via Provider ID Reuse

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: Canonical Ltd.

Description

In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102631

EUVD

EUVD-2026-102198

Affected Vendors & Products

Vendor	Product	Version / Range
Canonical	authd	0.1
Canonical	authd	0.1
Canonical	authd	0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

In authd before 0.7.1, a flaw in user identity matching allows an identity provider to reassign an email address to a new account. The new account then inherits the previous user's local UID and home directory, granting access to the previous user's files including credentials like SSH keys and cloud API tokens.

Detection Guidance

Check for users with conflicting provider IDs or reused usernames by inspecting authd logs and local account records. Look for login events where a new user inherits a previous user's UID or home directory. Review authd configuration files for identity matching logic.

Impact Analysis

This vulnerability allows a new user to access and modify files belonging to a previous user, including sensitive data like SSH keys and cloud API tokens. It could lead to unauthorized access, data breaches, or privilege escalation if an identity provider reassigns an email address.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, such as SSH keys and cloud API tokens, which may violate compliance requirements under GDPR and HIPAA. Unauthorized access to personal or health information could result in data breaches, triggering mandatory notifications and potential fines under these regulations.

Mitigation Strategies

Lock or delete local authd accounts when their corresponding IdP accounts are removed. Ensure authd is updated to version 0.7.1 or later to apply the security fix. Monitor for unauthorized access or file modifications in user home directories.

Hi! I’m here to help you understand CVE-2026-102631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70