CVE-2024-9312

Published: Oct 10, 2024Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: NVD

Description

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Affected (1)

Products: Canonical: Authd

Canonical

1 product

Authd

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Authd	Before 0.3.6

Related CWEs

CWE-286

Incorrect User Management

The product does not properly manage a user within its environment.

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

References (2)

https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2

Source: security@ubuntu.com

ExploitMitigationVendor Advisory

https://www.cve.org/CVERecord?id=CVE-2024-9312

Source: security@ubuntu.com

Third Party Advisory

Timeline

No history available yet.