Name: CVE-2026-87853: Partial String Comparison
Creator: Rapid7
Published: 2026-09-09T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-87853, CWE-187, CVSS 7.5, EPSS 0.00328

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Redhat_linux	—	Upgrade sssd-adUpgrade sssd-tools-debuginfoUpgrade libsss_certmapUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-kcmNo solution existsUpgrade libsss_autofsUpgrade sssd-krb5-commonUpgrade sssd-idpUpgrade sssd-common-debuginfoUpgrade libsss_sudo-debuginfoUpgrade sssd-proxy-debuginfoUpgrade libsss_autofs-debuginfoUpgrade sssd-ldap-debuginfoUpgrade libipa_hbac-debuginfoUpgrade sssd-ldapUpgrade python3-sssUpgrade python3-libsss_nss_idmapUpgrade sssd-krb5Upgrade sssd-debugsourceUpgrade sssd-nfs-idmapUpgrade sssdUpgrade libsss_nss_idmapUpgrade sssd-common-pac-debuginfoUpgrade sssd-idp-debuginfoUpgrade libsss_certmap-debuginfoUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-ipaUpgrade sssd-toolsUpgrade sssd-commonUpgrade sssd-clientUpgrade python3-sss-murmur-debuginfoUpgrade libsss_idmap-debuginfoUpgrade sssd-krb5-common-debuginfoUpgrade sssd-passkey-debuginfoUpgrade python3-sssdconfigUpgrade libsss_sudoUpgrade sssd-dbus-debuginfoUpgrade sssd-dbusUpgrade libsss_nss_idmap-develUpgrade python3-sss-debuginfoUpgrade sssd-nfs-idmap-debuginfoUpgrade sssd-winbind-idmapUpgrade sssd-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-client-debuginfoUpgrade python3-libipa_hbacUpgrade sssd-proxyUpgrade sssd-krb5-debuginfoUpgrade sssd-passkeyUpgrade sssd-common-pacUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_idmapUpgrade libipa_hbacUpgrade sssd-ipa-debuginfoUpgrade sssd-ad-debuginfoUpgrade python3-sss-murmurUpgrade libsss_nss_idmap-debuginfo	Sep 11, 2026	Sep 9, 2026
Rocky_linux	—	Upgrade sssd-ad-debuginfoUpgrade libsss_sudoUpgrade sssd-commonUpgrade libsss_nss_idmap-develUpgrade sssd-idp-debuginfoUpgrade sssd-client-debuginfoUpgrade sssd-krb5-commonUpgrade python3-libipa_hbac-debuginfoUpgrade sssd-dbus-debuginfoUpgrade sssd-winbind-idmapUpgrade sssd-krb5-common-debuginfoUpgrade sssd-passkey-debuginfoUpgrade libsss_nss_idmapUpgrade libipa_hbac-debuginfoUpgrade sssd-passkeyUpgrade sssd-kcmUpgrade sssd-common-pac-debuginfoUpgrade python3-sss-murmur-debuginfoUpgrade sssd-ipa-debuginfoUpgrade sssd-krb5-debuginfoUpgrade libipa_hbacUpgrade sssd-tools-debuginfoUpgrade sssd-adUpgrade python3-sssUpgrade sssd-ipaUpgrade python3-libsss_nss_idmap-debuginfoUpgrade libsss_nss_idmap-debuginfoUpgrade sssd-krb5Upgrade sssd-common-debuginfoUpgrade python3-libsss_nss_idmapUpgrade libsss_certmap-debuginfoUpgrade libsss_autofsUpgrade sssd-nfs-idmapUpgrade sssd-clientUpgrade sssd-winbind-idmap-debuginfoUpgrade sssd-kcm-debuginfoUpgrade sssd-debugsourceUpgrade libsss_idmap-debuginfoUpgrade sssdUpgrade libsss_idmapUpgrade libsss_autofs-debuginfoUpgrade python3-libipa_hbacUpgrade sssd-debuginfoUpgrade python3-sss-debuginfoUpgrade sssd-common-pacUpgrade sssd-proxy-debuginfoUpgrade sssd-nfs-idmap-debuginfoUpgrade python3-sss-murmurUpgrade libsss_sudo-debuginfoUpgrade libsss_certmapUpgrade sssd-ldapUpgrade sssd-idpUpgrade sssd-dbusUpgrade sssd-proxyUpgrade sssd-ldap-debuginfoUpgrade sssd-tools	Oct 15, 2026	Oct 9, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence