Technical impact
A flaw in SSSD's IdP authentication provider causes the eval_access_token_buf() function to perform a prefix comparison when checking the OIDC subject identifier, allowing an attacker whose IdP identifier is a strict prefix of a valid user’s identifier to authenticate as that user. The impact is an unauthorized privileged access, as the attacker can take on the identity of a legitimate system user, potentially escalating privileges or accessing sensitive resources. The weakness is identified as CWE-187, an improper comparison flaw.
Affected Systems
Affected products are Red Hat Enterprise Linux 10, 6, 7, 8, 9, and Red Hat OpenShift Container Platform 4, as all variants use the SSSD IdP provider. The vulnerability is present in all listed Red Hat releases that ship the affected version of SSSD.
Risk and Exploitability
The CVSS score of 7.5 indicates a high impact, and while the EPSS score is not available, the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires control of the IdP to supply a crafted subject identifier and use the normal IdP‑based authentication flow to trigger the prefix comparison. Because the flaw is in the authentication layer, an attacker can perform the attack without local privileges, making it a remotely exploitable condition.
