A flaw in SSSD causes the password‑expiration warning rule (pwd_expire_policy_warn) to terminate rule evaluation prematurely when it is processed before restrictive LDAP access rules. If an account has an expired password, the warning rule will treat the access request as successful, and a remote authenticated user can exploit this by using an alternative authentication method such as an SSH public key. The result is that the attacker is granted access to the system even though the account should be denied based on policy, effectively bypassing configured access controls. Affected systems include Red Hat Enterprise Linux releases 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4, as referenced by the CPE strings for those products. The vulnerability applies to the default SSSD configuration shipped with those distributions, regardless of the specific package version, because the issue is tied to the ordering of policy rules in the ldap_access_order setting. The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated user with an expired password who can authenticate via an alternative method. Exploitation requires only the presence of expired passwords and the mis‑ordered ldap_access_order configuration; no additional privileges or network access beyond the user’s own credentials are required.

Red Hat Enterprise Linux 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4 are affected. The vulnerability is tied to the ldap_access_order configuration in SSSD and therefore applies to those distributions where the default ordering places pwd_expire_policy_warn before restrictive access rules.

The CVSS score of 6.8 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated user whose account has an expired password but is able to authenticate via an alternative method such as SSH public key authentication. The exploitation conditions require the mis‑ordered ldap_access_order configuration and the presence of expired passwords; no additional privileges or network access beyond the user’s own credentials are required.