CyberRota Analysis
AI-GeneratedA vulnerability exists in the IdP authentication provider of SSSD, where the eval_access_token_buf() function incorrectly performs a prefix comparison of the OIDC subject identifier instead of an exact match. This flaw allows an attacker with a strict prefix of a target user's identifier to authenticate as that user, potentially leading to unauthorized access. Organizations utilizing SSSD for identity management should prioritize addressing this issue to mitigate the risk of credential misuse.
Original NVD Description
A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.