Identifying Insufficient User ID Randomization in Authd

CVE-2024-9312

Summary

An authentication vulnerability exists in Authd, up to version 0.3.6, where insufficient randomization of user IDs can lead to collisions. This flaw allows a local attacker, capable of registering usernames, to spoof another user's ID, subsequently gaining unauthorized access to their privileges. This situation poses a significant risk to user security and data integrity, necessitating immediate remediation.

References