USN-8957-1: authd bug allows inheriting another user's files

Canonical released the USN-8957-1 advisory on 27 October 2026 for a vulnerability in authd, the daemon that manages authentication to cloud identity providers such as Microsoft Entra ID and Google Cloud IAM on Ubuntu. It affects those who have already deployed authd in production to replace traditional local user accounts in /etc/passwd—a choice Canonical has been promoting as the default starting from the 26.04 LTS series.

What the bug does

The affected package is authd, with an upstream patch available at github.com/canonical/authd/pull/2067. According to the CVE record, in authd before 0.7.1, user identity matching in UpdateUser resolves an incoming login via the provider ID scoped to the broker, but falls back to username comparison when the provider ID does not match any known user, and does not reject a non-empty conflicting provider ID.

In practice, if an identity provider reassigns an email address, which authd uses as a username, to a new account, that new account inherits the local UID and home directory of the previous user on the next login. This allows the new user to access and modify the previous user's files, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity.

The associated CVE is CVE-2026-102631, with a CVSS score of 5.9/10 (MEDIUM severity) and CVSS vector 4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N, indicating local access, high attack complexity but high impact on the confidentiality of the vulnerable system.

Who is affected and what to do

The Ubuntu advisory covers the 26.10 release, where authd on 26.04 LTS is found to be vulnerable, whilst on 24.04 LTS and 22.04 LTS the package is not present in the release. The corrected version is 0.7.1. After standard system update, authd must be restarted for the changes to take effect.

Those unable to update immediately have an additional mitigation noted in the CVE record: remove or disable the previous user's local authd account when the corresponding IdP account is deleted, preventing a new account with the same email address from inheriting the UID and home directory.

For Ubuntu Pro users, extended security coverage for Main and Universe packages remains free for up to five machines, as noted on the advisory page.