Ubuntu fixes authd flaw that could map a cloud identity onto another user's account

Serguey Asael Shinder29 October 2026, 09:191 min read

Canonical has published USN-8957-1 for authd, the Ubuntu authentication daemon that lets users log in to a machine with an account from a cloud-based identity provider. According to the notice, authd did not properly validate user identities when matching accounts from identity providers to local accounts, and an attacker could possibly use this to gain access to another user's local account and files. The issue was discovered by Ali Mashally.

The fix is delivered as a package update. The notice adds one step that a routine upgrade does not do on its own: after the standard system update, authd needs to be restarted for the change to take effect.

What it means

authd exists to tie local Linux accounts to identities managed elsewhere, so a flaw in the matching step goes straight to the question of who a user is on the machine — the one thing the component is there to answer. Fleets that use authd for single sign-on should treat this as an access-control fix rather than a routine patch, and check that the restart actually happened, since an updated package with the old daemon still running leaves the gap open. The notice does not say which identity providers or matching configurations are affected, so assume all are until told otherwise.