Bug 2572591 (CVE-2026-127100)

Summary: CVE-2026-127100 sssd: sssd: Local denial of service through unchecked OAuth2 JSON code type in PAM responder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2572657    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-12 15:01:10 UTC 
A flaw was found in SSSD. The json_unpack_oauth2_code() function in src/responder/pam/pamsrv_json.c fails to validate that the OAuth2 JSON code field has string type. A present non-string value causes json_string_value() to return NULL. The function can return success with a NULL output, after which json_unpack_auth_reply() evaluates strlen(oauth2_code), causing a NULL pointer dereference and terminating sssd_pam. A local user able to connect to the PAM responder socket can provide crafted JSON authentication information and selection items before authentication. The affected code is conditional on HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION. The maintainer confirmed that the extension is enabled beginning with RHEL 9.8 and RHEL 10.2, and that the incoming selection data is not sanitized at the socket boundary. Exact affected builds and backports still require product assessment. Source report: PSIRTSUPT-25890, finding H-08. Related earlier record: OSIM-80264 / 559edf59-4ee2-49f9-95cd-d5d36b419a81; it was automatically rejected because no CVE was assigned, rather than on a technical invalidity determination.