USN-8957-1

Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.

References

Affected packages

Ubuntu:26.10 / authd

Package

Name: authd
Purl: pkg:deb/ubuntu/authd?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.1

Affected versions

0.*

0.6.1

0.6.1ubuntu0.1

0.7.0

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "authd",
            "binary_version":  "0.7.1"
        }
    ]
}

Database specific

cves_map

{
    "cves":  [
        {
            "id":  "CVE-2026-102631",
            "severity":  [
                {
                    "score":  "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:26.10"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8957-1.json"