# SSSD 2.13.0
The SSSD team is announcing the release of version 2.13.0 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.13.0
See the full release notes at:
https://sssd.io/release-notes/sssd-2.13.0.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-develhttps://lists.fedorahosted.org/mailman/listinfo/sssd-users
# SSSD 2.13.0 Release Notes
## Highlights
### General information
- Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey
responder
- During the processing of the `pam_sss_gss` request SSSD will read the
SID from the PAC of the Kerberos ticket and might add authentication
indicators based on the value of the new option
`pam_gssapi_indicators_apply`. The primary use case is to handle SIDs
added by Active Directory's Authentication Mechanism Assurance (AMA).
- Active Directory's Foreign Security Principals (FSP) are now properly
detected and ignored when reading nested group members. The
`ldap_ignore_unreadable_references` option is only needed to ignore
member objects which are really not accessible.
- A number of cache performance optimizations for large deployments.
### New features
- Tokens acquired from the IdP are now stored in the domain cache, and
are automatically refreshed if the new option `idp_auto_refresh` is enabled.
- `idp_type` option allows `entra_idp` url to be specified if user is
using a different Microsoft Entra endpoint.
- KDE Plasma Login Manager support.
### Configuration changes
- New option `avoid_by_id_lookups` to tell the SSSD responders to use a
lookup by name instead of by id where possible
- New options to customize the OAuth2 prompting behavior: `interactive`
and `interactive_prompt`.
### Packaging changes
- New `./configure` option `--enable-sensitive-logs` to enable logging
of sensitive data (like, for example, IdP tokens). Recommended for debug
builds only.