Skip to content
Heist/ feed
Back to feed
UnratedFix available

authd vulnerability

Type: advisorySources: OSV

Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.

Products
authd
Affected versions
0.6.1, 0.6.1ubuntu0.1, 0.7.0
Fixed versions
0.7.1
CVEs
CVE-2026-102631
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 15:10 UTC · Revision 1

Source evidence

authd vulnerability

core-osv · Original source

Published 27 Oct 2026, 16:23 UTC

Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.

osv:USN-8957-1

authd

Fixed versions: 0.7.1

Complete source record
{
  "id": "7a7ee475fd57124cc096438d95bd742586a1379a2e3e276717209c8719188af1",
  "url": "https://osv.dev/vulnerability/USN-8957-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "authd vulnerability",
    "summary": "Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.",
    "evidence": "osv:USN-8957-1",
    "products": [
      {
        "name": {
          "value": "authd",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.7.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.6.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.6.1ubuntu0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.7.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "USN-8957-1",
      "aliases": [
        "USN-8957-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.7.1"
                }
              ]
            }
          ],
          "package": {
            "name": "authd",
            "purl": "pkg:deb/ubuntu/authd?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "0.6.1",
            "0.6.1ubuntu0.1",
            "0.7.0"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8957-1.json",
            "cves_map": {
              "cves": [
                {
                  "id": "CVE-2026-102631",
                  "severity": [
                    {
                      "type": "CVSS_V4",
                      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
                    },
                    {
                      "type": "Ubuntu",
                      "score": "medium"
                    }
                  ]
                }
              ],
              "ecosystem": "Ubuntu:26.10"
            }
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "authd",
                "binary_version": "0.7.1"
              }
            ],
            "availability": "No subscription required"
          }
        }
      ],
      "modified": "2026-10-28T01:13:12.296686384Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-102631",
        "UBUNTU-CVE-2026-102631"
      ],
      "references": [
        "https://ubuntu.com/security/notices/USN-8957-1",
        "https://ubuntu.com/security/CVE-2026-102631"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-102631",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 486279,
  "published_at": "2026-10-27T16:23:37+00:00"
}