CVE-2026-102631

The authd utility before version 0.7.1 is vulnerable to account takeover in the UpdateUser function (internal/users/manager.go). The root cause is an improper identity matching logic that falls back to matching a username when a provider ID is not recognized, without rejecting conflicting non-emp...

EUVD-2026-102198

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...