User Identity Matching Vulnerability in Authd by Canonical
CVE-2026-102631
What is CVE-2026-102631?
A user identity matching vulnerability has been identified in Authd before version 0.7.1, where the system allows risky access permissions due to improper handling of provider IDs during login. When an identity provider reassigns an email address, the newly created account can inherit the previous user's local user ID (UID) and home directory, compromising sensitive files, including SSH keys and cloud API tokens. This situation arises as the system defaults to username matching without blocking a conflicting non-empty provider ID. To prevent unauthorized access, it is crucial for administrators to delete or lock the prior user's local Authd account once the associated identity provider account is removed.
Affected Version(s)
authd Linux 0.1 < 0.7.1
authd Linux 0.1 < 0.7.1~ubuntu24.04.1
authd Linux 0.1 < 0.7.1~ubuntu26.04