CVE-2026-102631

Name of the Vulnerable Software and Affected Versions authd versions prior to 0.7.1

Description User identity matching in the UpdateUser() function (located in internal/users/manager.go) resolves logins using a broker-scoped provider ID. If the provider ID is not recognized, the system falls back to matching the username without rejecting conflicting non-empty provider IDs. If an identity provider reassigns an email address (used as the username) to a new account, that new account inherits the local UID and home directory of the previous user upon login. This allows the new user to access and modify the previous user's files, including SSH keys and cloud API tokens, while silently rebinding the local account record to the new identity.

Recommendations Update to version 0.7.1 or later. Lock or delete the previous user's local authd account when the corresponding identity provider account is removed.