CVE-2026-104033

What it actually does

SSSD configured for LDAP shadow attribute account expiration ignores a shadowExpire value of zero and permits authentication for accounts that should be treated as expired.

Why it matters to the business

Accounts that administrators intended to deactivate remain usable, allowing continued unauthorized access and undermining account lifecycle controls.

How an attack unfolds

An attacker obtains valid credentials for an account whose shadowExpire attribute is set to zero. Because SSSD does not interpret zero as expired, the authentication request succeeds and the attacker gains access to the system.

How to fix it

Upgrade SSSD to a version that correctly treats a shadowExpire value of zero as an expired account. Until a fixed package is available, consider disabling LDAP shadow expiration enforcement or moving expiration logic to another attribute or mechanism.

How to confirm the fix worked

After applying the update, create a test account with shadowExpire set to zero, attempt authentication, and confirm the login is rejected. Review SSSD debug logs for correct expiration evaluation.

Typical attack path

1. Identify or compromise credentials belonging to an LDAP-managed account marked with shadowExpire=0
2. Initiate authentication against a host using SSSD with LDAP shadow expiration enforcement enabled
3. Bypass the intended expiration check and obtain an active session

How to detect it

Search authentication logs for successful logins involving accounts whose LDAP shadowExpire attribute is zero. Correlate with directory queries showing shadowExpire updates around the time of login.

What your security team should do

• Prioritize patching SSSD on all systems that rely on LDAP shadow attributes for expiration
• Audit LDAP directory for accounts with shadowExpire=0 that may still be authenticating
• Add monitoring for successful authentications on accounts that should be expired