CVE-2024-9313

8.8 highEPSS 0.6%

High (8.8) in canonical authd. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/ubuntu/authd 0.0.0-20240930103526-63e527496b01, 0.3.5.

Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
Published: 2024-10-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:authd

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-x5q3-c8rm-w787	Go	github.com/ubuntu/authd	<0.0.0-20240930103526-63e527496b01	0.0.0-20240930103526-63e527496b01
GHSA-x5q3-c8rm-w787	Go	github.com/ubuntu/authd	>=0.1.0 <0.3.5	0.3.5
GO-2024-3181	Go	github.com/ubuntu/authd	<0.3.5	0.3.5

References

https://github.com/ubuntu/authd/security/advisories/GHSA-x5q3-c8rm-w787
https://www.cve.org/CVERecord?id=CVE-2024-9313

Check your stack JSON