Ubuntu authd flaw CVE-2026-102631 allows account takeover via cloud identity providers

Ubuntu has published security notice USN-8957-1 for authd, the authentication daemon that integrates cloud-based identity providers with local Ubuntu systems. Security researcher Ali Mashally found that authd fails to properly validate user identities when matching accounts from external identity providers to local accounts, allowing an attacker to potentially gain access to another user's local account and files. The vulnerability affects Ubuntu 26.10 and is tracked as CVE-2026-102631.

The flaw represents a significant authentication bypass in a component designed to bridge cloud identity services with local Linux authentication. Affected users should update to authd version 0.7.1 and restart the daemon to apply the fix. The defect class is improper validation during identity federation, with attack scenarios involving account confusion between distinct users from the same or connected identity providers.

Vulnerability details and affected systems

• CVE identifier: CVE-2026-102631, a single CVE assigned to this authd validation flaw.
• Affected software: authd 0.7.0 and earlier on Ubuntu 26.10; fixed in authd 0.7.1.
• Defect class: Improper validation of user identities during account matching from cloud identity providers to local system accounts.
• Attack vector: An attacker can exploit the flawed matching logic to have their cloud identity mapped to a different user's local account, gaining unauthorized access to that user's files and sensitive information.
• Remediation: Standard system update to authd 0.7.1 followed by a daemon restart is required to fully apply the fix.

Why it matters

This vulnerability directly undermines trust in cloud-identity integration on Ubuntu workstations and servers, a deployment pattern increasingly common in enterprise Linux environments using Azure AD, Okta, or similar providers. For system administrators, the flaw demonstrates the risks of identity federation bugs where local account isolation fails, and the required post-update daemon restart is a critical step that automated patching tools might overlook. The authd project, developed by Canonical for Ubuntu, will need broader scrutiny of its identity mapping logic as similar architectures spread across Linux distributions.