CVE-2026-102631

The authd utility before version 0.7.1 is vulnerable to account takeover in the UpdateUser function (internal/users/manager.go). The root cause is an improper identity matching logic that falls back to matching a username when a provider ID is not recognized, without rejecting conflicting non-emp...