CVE-2023-3758High· 7.1▾ TwilightA race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.0%
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
sssd < 2.9.5sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssd (all versions)sssdsssdRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
A mitigation can be applied to the sssd.conf file that would make the occurrence of the race condition more difficult:
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-68744Low· 3.3Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
CVE-2026-68742Medium· 5.5Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr
CVE-2026-68743Medium· 5.5Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
CVE-2026-103112High· 7.5Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
CVE-2023-42756Medium· 4.4Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
CVE-2026-118030Medium· 4.2Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins