Authd CVE-2025-5689

CVSS 8.5 indicates high severity (AV:N/AC:L/PR:L/S:C/C:H/I:L/A:N), but this score requires proper contextualization: The attack requires PR:L (Low Privilege), meaning an attacker must already have valid credentials and SSH access—this is not an unauthenticated attack. AC:L (Low Complexity) means exploitation is straightforward once access is gained. The scope change (S:C) and high confidentiality impact (C:H) suggest the attacker can access files/data restricted to root group, which is substantial. However, real-world risk depends on: (1) whether the system uses first-time user authentication patterns, (2) authentication infrastructure configuration, and (3) whether this has been added to CISA KEV catalog or actively exploited. Without explicit KEV status or EPSS data provided, the true exploitation probability remains uncertain. Organizations with strict SSH key management and no dynamic first-time authentication may face lower practical risk than those with centralized authentication and frequent new user onboarding. This is a 'medium-to-high priority' vulnerability—not critical, but requiring prompt patching in affected environments.

A threat actor with valid credentials (e.g., a former contractor, compromised low-privilege account, or via phishing/credential stuffing) initiates their first SSH login to a target system. The authd daemon creates a temporary user record for authentication and incorrectly assigns root group (GID 0) membership due to this flaw. Once authenticated, the attacker's SSH session runs with root group privileges, allowing them to: (1) read files group-owned by root (typically /etc/shadow, database files, configuration files), (2) modify group-writable files to plant persistence mechanisms or escalate further, or (3) gather sensitive information not normally accessible to unprivileged users. The attack is not a full privilege escalation to UID 0 (root user), but rather a group membership escalation that enables unauthorized access to sensitive resources. No public proof-of-concept exploitation has been noted in the provided data, but the straightforward nature of the flaw (AC:L) suggests PoC development would be trivial for skilled attackers. Attack complexity is low because exploitation simply requires authenticating with valid credentials and logging in for the first time—no additional exploitation techniques needed.