CVE-2026-90462

Name of the Vulnerable Software and Affected Versions SSSD (affected versions not specified)

Description A flaw exists when the software is configured with the LDAP access provider and the ldap access order variable includes ppolicy or lockout. A fail-open condition occurs during the LDAP ppolicy access check if a user lookup returns zero results. This leads to an incorrect success response and caches an allow decision, which enables continued authorization for users who have been deleted or deprovisioned. A remote attacker with prior valid account context can exploit this to maintain access to information and potentially make limited modifications to resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.