Zurück zu den Sicherheitshinweisen

Authd Vulnerability — Ubuntu Security Update (USN-8957-1)

USN-8957-1 fixes CVE-2026-102631 in Ubuntu's authd — the authentication daemon for cloud-based identity providers did not properly validate user identities when matching accounts, allowing an attacker to gain access to another user's local account and files (CWE-287 improper authentication, CVSS 5.9). Update authd on affected Ubuntu releases: sudo apt update && sudo apt upgrade authd.

High 5.9 CVSS
Ubuntu 20.04 Ubuntu 22.04

Was das unter einer SharedLicense-Lizenz bedeutet

Identity-matching flaws in an authentication daemon mean one cloud identity can be matched to another user's local account — unauthorized access to their files and permissions without knowing their password.

  1. Ubuntu Security Notices

  2. USN-8957-1

Publication date

27 October 2026

Overview

authd could allow unauthorized access to another user’s files under
certain circumstances.

Releases


26.10

Open side navigation

Packages

  • authd – Authentication daemon for cloud-based identity provider

Details

Ali Mashally discovered that authd did not properly validate user
identities when matching accounts from identity providers. An attacker
could possibly use this issue to gain access to another user’s local
account and files, resulting in unauthorized access to sensitive
information.

Ali Mashally discovered that authd did not properly validate user
identities when matching accounts from identity providers. An attacker
could possibly use this issue to gain access to another user’s local
account and files, resulting in unauthorized access to sensitive
information.

Update instructions

After a standard system update you need to restart authd to make
all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 authd – 

0.7.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Häufig gestellte Fragen

What is USN-8957-1?
It is Ubuntu's security notice (published October 27, 2026) for CVE-2026-102631 in authd, the authentication daemon for cloud-based identity providers: improper identity validation could let an attacker access another user's local account and files.
Who is affected?
Ubuntu systems (the notice lists release 26.10) running authd with cloud identity-provider integration — typical on cloud-provisioned images using SSO-style login.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade authd, then restart the authd service. Environments using cloud identity login should verify user-to-account mappings behave correctly afterwards.
How severe is this for a hosting server?
Directly relevant mainly to Ubuntu machines using authd for identity-based login. Standard password-based hosting servers are unaffected — but where authd is in use, the flaw crosses user boundaries, which is why it should be patched promptly.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen