CVE-2025-5689
published 2025-06-16CVE-2025-5689: A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part…
PriorityP346high8.5CVSS 3.1
AVNACLPRLUINSCCHILAN
EPSS
0.26%
16.9th percentile
A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | authd | < 0.5.4 | 0.5.4 |
| canonical | authd | 0.0.0 – 0.5.4 | — |
| github.com | ubuntu_authd | >= 0 < 0.5.4 | 0.5.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
osv·2025-07-28
CVE-2025-5689 New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
New authd users logging in via SSH are members of the root group in github.com/ubuntu/authd
GHSA
New authd users logging in via SSH are members of the root group
ghsa·2025-06-16
CVE-2025-5689 [MEDIUM] CWE-266 New authd users logging in via SSH are members of the root group
New authd users logging in via SSH are members of the root group
### Impact
When an authd user logs in via SSH for the first time (meaning they do not yet exist in the authd user database) and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user to read and write files that are accessible by the root group, to which they should not have access. The user does not get root privileges or any capabilities beyond the access granted to the root group.
**Preconditions under which this vulnerability affects a system**
* authd was [installed via the PPA](https://documentation.ubuntu.com/authd/latest/howto/install-authd/#install-authd).
* An OAuth 2.0 application was registered
OSV
New authd users logging in via SSH are members of the root group
osv·2025-06-16
CVE-2025-5689 [MEDIUM] New authd users logging in via SSH are members of the root group
New authd users logging in via SSH are members of the root group
### Impact
When an authd user logs in via SSH for the first time (meaning they do not yet exist in the authd user database) and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user to read and write files that are accessible by the root group, to which they should not have access. The user does not get root privileges or any capabilities beyond the access granted to the root group.
**Preconditions under which this vulnerability affects a system**
* authd was [installed via the PPA](https://documentation.ubuntu.com/authd/latest/howto/install-authd/#install-authd).
* An OAuth 2.0 application was registered
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-16
Published