Description
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
smp46 pingvin-share-x
Default version status: unaffected
0.19.0 to < 1.22.0affected
References
- https://github.com/smp46/pingvin-share-x/security/advisories/GHSA-wrcg-4874-45p7 ↗
- https://github.com/smp46/pingvin-share-x/commit/07aa8c0a96030c439e9018ce94a2778bd37304e6 ↗
- https://github.com/smp46/pingvin-share-x/blob/de7ffecf9bfc4976993149a5c4c98efe35161424/backend/src/oauth/oauth.service.ts#L158-L175 ↗
- https://github.com/smp46/pingvin-share-x/releases/tag/v1.22.0 ↗
- https://github.com/smp46/pingvin-share-x ↗
- https://www.vulncheck.com/advisories/pingvin-share-x-0.19.0-before-1.22.0-account-takeover-via-oauth-email-linking ↗