CVE-2026-104033

Published: Oct 6, 2026Modified: Oct 7, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.

Related CWEs

CWE-193

Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

References (3)

https://access.redhat.com/security/cve/CVE-2026-104033

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2479271

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2479271

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.