A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77534 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_77534 advisory.

    * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:77534 advisory.

    * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:77534 advisory.

    * sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation (CVE-2026-87853)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-77534 advisory.

    - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf()
    - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for     sudoRole

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the     OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a     prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a     target user's identifier can authenticate as the target user. (CVE-2026-87853)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369309	RHEL 10 : sssd (RHSA-2026:77534)	Nessus	Red Hat Local Security Checks	Local	high
364578	Rocky Linux 10.2 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc (crlsa-2026_77534)	Nessus	Rocky Linux Local Security Checks	Local	high
364485	AlmaLinux 10 : sssd (ALSA-2026:77534)	Nessus	Alma Linux Local Security Checks	Local	high
364447	RockyLinux 10 : sssd (RLSA-2026:77534)	Nessus	Rocky Linux Local Security Checks	Local	high
364350	Oracle Linux 10 : sssd (ELSA-2026-77534)	Nessus	Oracle Linux Local Security Checks	Local	high
344337	Linux Distros Unpatched Vulnerability : CVE-2026-87853	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-87853

high

Tenable Plugins

high

high

high

high

high

high