Authd (Canonical) - vulnerabilities (CVEs)

3 CVEs, 1 in the last 30 days, 15 known versions, newest CVE from 2026-10-15. Vendor: Canonical.

CVEs of Authd

• CVE-2026-102631 - CVSS 5.9 (medium), 2026-10-15: In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but…
• CVE-2026-6970 - CVSS 7.3 (high), 2026-04-27: authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID…
• CVE-2025-5689 - CVSS 8.5 (high), 2025-06-16: A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part…
• CVE-2024-9312 - CVSS 7.5 (high), 2024-10-10: Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another…
• CVE-2024-9313 - CVSS 8.8 (high), 2024-10-03: Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation…