CVE-2026-102631
published 2026-10-15CVE-2026-102631: In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but…
PriorityP427medium5.9CVSS 4.0
AVLACHATPPRNUINVCHVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.11%
1.4th percentile
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | authd | >= 0.1 < 0.7.1 | 0.7.1 |
| canonical | authd | >= 0.1 < 0.7.1~ubuntu24.04.1 | 0.7.1~ubuntu24.04.1 |
| canonical | authd | >= 0.1 < 0.7.1~ubuntu26.04 | 0.7.1~ubuntu26.04 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Canonical authd up to 0.7.0 User Identity Matching manager.go UpdateUser improper authentication (EUVD-2026-102198)
vuldb·2026-10-16·CVSS 5.9
CVE-2026-102631 [MEDIUM] Canonical authd up to 0.7.0 User Identity Matching manager.go UpdateUser improper authentication (EUVD-2026-102198)
A vulnerability was found in Canonical authd up to 0.7.0. It has been rated as very critical. The impacted element is the function UpdateUser of the file internal/users/manager.go of the component User Identity Matching. Performing a manipulation results in improper authentication.
This vulnerability is known as CVE-2026-102631. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
GHSA
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when th
ghsa_unreviewed·2026-10-15
CVE-2026-102631 [MEDIUM] CWE-287 In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when th
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-15
Published