CVE-2026-102631 Details
Description
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed.
A vulnerability in authd versions prior to 0.7.1 allows a new user to inherit the local UID and home directory of a previous user, leading to unauthorized access to the former user's files, including sensitive credentials like SSH keys and cloud API tokens. This issue arises because the identity matching process in UpdateUser falls back to the username when the broker-scoped provider ID does not correspond to a known user. As a result, if an identity provider reassigns an email address to a new account, the new account can gain access to the previous user's files and credentials. Administrators are advised to lock or delete the old user's local authd account when their identity provider account is removed.
The vulnerability has been fixed in authd version 0.7.1. Administrators should also lock or delete the local authd account of users whose IdP accounts have been removed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.launchpad.net/ubuntu/+source/authd/+bug/2168531 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/canonical/authd/pull/2067 | [email protected] | Issue TrackingVendor |
| https://ubuntu.com/security/CVE-2026-102631 | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ubuntu authd | < 0.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |