CVE-2026-127100

A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.

• CWE-476

• https://access.redhat.com/security/cve/CVE-2026-127100
• https://bugzilla.redhat.com/show_bug.cgi?id=2572591

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127063The third-party RMM+ extension for ConnectWise ScreenConnect…9.3
• CVE-2026-12707Summary Cloudflare quiche was discovered to be vulnerable…7.5
• CVE-2026-12708Summary Cloudflare tokio-quiche was found to contain an un…8.7
• CVE-2026-127099A flaw was found in SSSD's conversion of X.509 certificate R…5.9
• CVE-2026-1271The ProfileGrid – User Profiles, Groups and Communities plug…5.3
• CVE-2026-12710A Missing Authorization vulnerability in the QueryEngineTask…9.3
• CVE-2026-127101A flaw was found in SSSD's PAM responder. A local attacker c…5.5
• CVE-2026-127109A code injection vulnerability in promzard’s template-loadin…
• CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5