CVE-2026-41574: Github.com/nhost/nhost Nhost Vulnerable To Account Takeover Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g38-8j4p-j3pr",
  "modified" : "2026-05-14T20:30:38Z",
  "published" : "2026-04-18T01:00:06Z",
  "aliases" : [ "CVE-2026-41574" ],
  "summary" : "Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass",
  "details" : "## Summary\n\nNhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been **verified by the OAuth provider**. Nhost's controller trusts a `profile.EmailVerified` boolean that is set by each provider adapter.\n\nThe vulnerability is that several provider adapters **do not correctly populate this field** they either silently drop a `verified` field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified.\n\nThe result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session.\n\n## Root Cause\n\nIn `services/auth/go/controller/sign_in_id_token.go`, `providerFlowSignIn()` links a new provider identity to an existing account by email match with no verification guard:\n\n```go\n// sign_in_id_token.go:267-296\nfunc (ctrl *Controller) providerFlowSignIn(\n    ctx context.Context,\n    user sql.AuthUser,\n    providerFound bool,\n    provider string,\n    providerUserID string,\n    logger *slog.Logger,\n) (*api.Session, *APIError) {\n    if !providerFound {\n        // Links attacker's provider identity to the victim's account.\n        // profile.EmailVerified is NEVER checked here.\n        ctrl.wf.InsertUserProvider(ctx, user.ID, provider, providerUserID, logger)\n    }\n    // Issues a full session  to the attacker.\n    session, _ := ctrl.wf.NewSession(ctx, user, nil, logger)\n    return session, nil\n}\n```\n\nThe controller places full trust in whatever `profile.EmailVerified` the adapter returned. The vulnerabilities below show how that trust is violated.\n\n## Correct Implementation (For Reference)\n\n### GitHub: `providers/github.go`\n\nGitHub fetches `/user/emails` and reads the `verified` boolean per entry. `selectEmail()` picks only verified emails. The result is correctly mapped:\n\n```go\nselected := selectEmail(emails)   // only selects verified: true entries\n\nreturn oidc.Profile{\n    Email:         selected.Email,\n    EmailVerified: selected.Verified,  // real boolean from GitHub API\n    ...\n}\n```\n\n## Vulnerable Providers\n\n### 1. Discord: `providers/discord.go`\n\n**The Discord `GET /users/@me` API returns a `verified` boolean field.** Per Discord's official documentation and example User Object:\n\n```json\n{\n  \"id\": \"80351110224678912\",\n  \"username\": \"Nelly\",\n  \"email\": \"nelly@discord.com\",\n  \"verified\": true\n}\n```\n\nThe Nhost struct is **missing this field**. Go's JSON decoder silently discards it:\n\n```go\ntype discordUserProfile struct {\n    ID            string `json:\"id\"`\n    Username      string `json:\"username\"`\n    Discriminator string `json:\"discriminator\"`\n    Email         string `json:\"email\"`\n    Locale        string `json:\"locale\"`\n    Avatar        string `json:\"avatar\"`\n    // MISSING: Verified bool `json:\"verified\"`\n}\n```\n\nThe adapter then sets:\n\n```go\nEmailVerified: userProfile.Email != \"\",  // always true when email is present\n```\n\n**Why this is exploitable:** Discord allows users to create account without verifying the email address and change their email address without immediately verifying it. After changing email, the account has `\"verified\": false` in the API response until the user clicks a confirmation link. An attacker can change their Discord email to the victim's address, leave it unverified, and the Nhost adapter will still present `EmailVerified: true`, because it never reads the `verified` field at all.\n\n**Fix:**\n\n```go\ntype discordUserProfile struct {\n    ID            string `json:\"id\"`\n    Username      string `json:\"username\"`\n    Discriminator string `json:\"discriminator\"`\n    Email         string `json:\"email\"`\n    Verified      bool   `json:\"verified\"`   // add this\n    Locale        string `json:\"locale\"`\n    Avatar        string `json:\"avatar\"`\n}\n\nreturn oidc.Profile{\n    Email:         userProfile.Email,\n    EmailVerified: userProfile.Verified,    // use it\n    ...\n}\n```\n\n### 2. Bitbucket: `providers/bitbucket.go`\n\nThe Bitbucket adapter correctly queries `/user/emails` for confirmed entries, but introduces a fallback that defeats its own check:\n\n```go\n// bitbucket.go:103-132\nfor _, e := range emailResp.Values {\n    if e.IsConfirmed {\n        primaryEmail = e.Email\n        break\n    } else if fallbackEmail == \"\" {\n        fallbackEmail = e.Email     // stores unconfirmed email\n    }\n}\n\nif primaryEmail == \"\" {\n    if fallbackEmail == \"\" {\n        return oidc.Profile{}, ErrNoConfirmedBitbucketEmail\n    }\n    primaryEmail = fallbackEmail    //  uses unconfirmed email\n}\n\nreturn oidc.Profile{\n    Email:         primaryEmail,\n    EmailVerified: primaryEmail != \"\",  //  marks it true anyway\n    ...\n}\n```\n\nBitbucket's `/user/emails` endpoint returns all emails, including unconfirmed ones with `\"is_confirmed\": false`. An attacker can add the victim's email to their Bitbucket account without confirming it, triggering the fallback path.\n\n**Fix:**\n\n```go\nif primaryEmail == \"\" {\n    // Remove the fallback entirely  no confirmed email means no sign-in\n    return oidc.Profile{}, ErrNoConfirmedBitbucketEmail\n}\n```\n\n### 3. AzureAD: `providers/azuread.go`\n\nAzureAD derives the email through a chain of fallbacks from the userinfo response:\n\n```go\nemail := userProfile.Email\nif email == \"\" {\n    email = userProfile.Prefer   // \"preferred_username\"  not an email ownership proof\n}\nif email == \"\" {\n    email = userProfile.UPN      // User Principal Name  not an email ownership proof\n}\n\nreturn oidc.Profile{\n    Email:         email,\n    EmailVerified: email != \"\",  // marked verified regardless of source\n    ...\n}\n```\n\n`preferred_username` and UPN are internal Azure AD identity attributes. A UPN like `attacker@tenant.onmicrosoft.com` or a custom UPN set to `ceo@target-company.com` does not prove that the user controls that external email address. Yet Nhost will treat it as a verified email claim and merge identities if an existing account matches.\n\n**Fix:** Do not fall back to `preferred_username` or UPN for account-linking email. Only use a field that Azure AD explicitly certifies as a verified external email (or use the OIDC `id_token` with the `email_verified` claim from Azure's v2 endpoint).\n\n### 4. EntraID: `providers/entraid.go`\n\nSame pattern as AzureAD. The EntraID adapter reads from `graph.microsoft.com/oidc/userinfo` but the struct has no `email_verified` field:\n\n```go\ntype entraidUser struct {\n    Sub        string `json:\"sub\"`\n    GivenName  string `json:\"givenname\"`\n    FamilyName string `json:\"familyname\"`\n    Email      string `json:\"email\"`\n    // MISSING: EmailVerified bool `json:\"email_verified\"`\n}\n\nreturn oidc.Profile{\n    Email:         userProfile.Email,\n    EmailVerified: userProfile.Email != \"\",  // unconditional\n    ...\n}\n```\n\nMicrosoft's OIDC userinfo endpoint does include an `email_verified` claim per the OpenID Connect specification. Nhost ignores it.\n\n**Fix:** Add `EmailVerified bool \\`json:\"email_verified\"`` to the struct and map it correctly.\n\n## Attack Scenario (Discord)\n\n**Setup:** An Nhost application uses Discord OAuth. A victim has an account with `admin@target.io`.\n\n1. Attacker opens **Discord → User Settings → Account**, changes email to `admin@target.io`, and dismisses the dialog, **without clicking the confirmation link**.\n    \n2. At this point Discord's API returns `\"email\": \"admin@target.io\", \"verified\": false` for the attacker's account.\n    \n3. Attacker visits the target application and clicks **Sign in with Discord**.\n    \n4. Nhost fetches the Discord profile. The missing `Verified` field in the struct causes the JSON decoder to drop it. The adapter sets `EmailVerified: true` because `\"admin@target.io\" != \"\"`.\n    \n5. Nhost finds the victim's account by email, sees no Discord provider row linked to it, and calls `InsertUserProvider` to link the attacker's Discord ID.\n    \n6. Nhost issues a full session for the victim's account and returns it to the attacker.\n    \n7. **The attacker is now authenticated as the victim.**\n    \n\nThe attack is silent, the victim receives no notification and the session appears entirely legitimate.\n\n## Defense-in-Depth Gap (Informational)\n\nSeveral other providers also use `EmailVerified: email != \"\"`, the same logical pattern as the vulnerable ones above. However, these are **not currently exploitable** because the platforms themselves enforce email verification before returning an address in the API response:\n\n|Provider|API Field Used|Why Not Exploitable Today|\n|---|---|---|\n|**Twitch**|`email` string only|Twitch requires email verification at sign-up; the API never returns an unverified email|\n|**GitLab**|`email` string only|`GET /api/v4/user` only returns the confirmed primary email|\n|**Facebook**|`email` via Graph API|Facebook only includes email in the response when it is confirmed|\n|**Twitter**|`email` via `verify_credentials`|Twitter requires a working email address on the account|\n|**Spotify**|`email` string only|Spotify enforces verification before account activation|\n|**Windows Live**|`preferred` `account` email|Microsoft's Live API only surfaces confirmed addresses|\n|**WorkOS**|`email` from SSO profile|Controlled by the enterprise IdP|\n\nThese providers happen to be safe due to **external platform behavior, not due to any validation in Nhost's code.** The `email != \"\"` shortcut is fragile:\n\n- If any of these platforms change how their API works, Nhost silently becomes exploitable for that provider.\n    \n- Any developer adding a new provider in the future will likely copy the same pattern, believing it is the established convention, creating vulnerabilities in new integrations.\n    \n\nFor this reason, the controller-level guard in Layer 1 of the fix below is important even beyond the four currently vulnerable providers: it makes the system safe by design regardless of what any individual adapter returns.\n\n## Impact\n\n- Full account takeover of any existing Nhost user.\n    \n- Requires no interaction from the victim.\n    \n- Attacker can change the account email, disable other login methods, and permanently lock out the legitimate owner.\n    \n- Severity escalates to Critical in applications with admin or privileged accounts.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/nhost/nhost"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260417112436-ec8dab3f2cf4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nhost/nhost/security/advisories/GHSA-6g38-8j4p-j3pr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41574"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nhost/nhost/pull/4162"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nhost/nhost/commit/ec8dab3f2cf46e1131ddaf893d56c37aa00380b2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nhost/nhost"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nhost/nhost/releases/tag/auth%400.49.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-287" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-18T01:00:06Z",
    "nvd_published_at" : "2026-05-08T15:16:40Z"
  }
}