authd does not reject a conflicting non‑empty provider ID when a provisioned IdP email is reassigned; the username fallback allows a new user to be matched to a prior account. The attacker therefore gains the prior user’s local UID and home directory, enabling read and write access to files such as SSH keys and cloud API tokens. This flaw is an instance of improper authentication (CWE‑287) that allows an unauthorized user to imitate a legitimate account.

Canonical’s authd component, versions prior to 0.7.1, is affected. The vulnerability resides in the UpdateUser routine (internal/users/manager.go). Only installations running a vulnerable version of authd are susceptible.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low current likelihood of exploitation. Since the flaw requires an identity provider to reassign an email address that authd uses as the username—and no direct remote trigger is provided—the attack surface is limited to environments where such email reassignments occur. The vulnerability is not listed in CISA’s KEV catalog, reinforcing that no widespread exploitation is currently reported. Administrators should therefore consider the threat as low-to‑moderate in typical settings, but should still apply mitigations to guard against potential account takeover.