Bug 2572657

Summary: CVE-2026-127100 sssd: sssd: Local denial of service through unchecked OAuth2 JSON code type in PAM responder [fedora-all]
Product: [Fedora] Fedora Reporter: Samuele Negrini <snegrini>
Component: sssdAssignee: sssd-maintainers <sssd-maintainers>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: abokovoy, atikhono, lslebodn, pbrezina, sbose, ssorce, sssd-maintainers
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["57c14169-6883-42e1-930d-b6fb66d10993"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2572591    

Description Samuele Negrini 2026-11-12 16:41:26 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in SSSD. The json_unpack_oauth2_code() function in src/responder/pam/pamsrv_json.c fails to validate that the OAuth2 JSON code field has string type. A present non-string value causes json_string_value() to return NULL. The function can return success with a NULL output, after which json_unpack_auth_reply() evaluates strlen(oauth2_code), causing a NULL pointer dereference and terminating sssd_pam. A local user able to connect to the PAM responder socket can provide crafted JSON authentication information and selection items before authentication. The affected code is conditional on HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION. The maintainer confirmed that the extension is enabled beginning with RHEL 9.8 and RHEL 10.2, and that the incoming selection data is not sanitized at the socket boundary. Exact affected builds and backports still require product assessment. Source report: PSIRTSUPT-25890, finding H-08. Related earlier record: OSIM-80264 / 559edf59-4ee2-49f9-95cd-d5d36b419a81; it was automatically rejected because no CVE was assigned, rather than on a technical invalidity determination.