[medium] OIDC links accounts by email across different `sub` values #11

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: medium
Affects: main

File: oidc_controller.ex:207-214
No user for provider+sub, but a user with the same email and provider 'oidc' exists → logged in as that user. No email_verified check. On an IdP where users can set their email, that's account takeover.
Fix: match on provider+sub only; if you keep email linking, require user_info["email_verified"] == true.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** medium **Affects:** main File: oidc_controller.ex:207-214 No user for provider+sub, but a user with the same email and provider 'oidc' exists → logged in as that user. No email_verified check. On an IdP where users can set their email, that's account takeover. Fix: match on provider+sub only; if you keep email linking, require user_info["email_verified"] == true. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

medium

security

main

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue from a pull request that will close it,

2026-10-18 17:18:22 +00:00

fix: only link OIDC logins by email when the provider verified it #37

jfro referenced this issue from a commit

2026-10-18 17:18:22 +00:00

fix: only link OIDC logins by email when the provider verified it