CRITICAL🇵🇱 Wersja polska

CVE-2026-41574

CVSS 9.3v4.0pub. 2026-05-08upd. 2026-05-13

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

Nhost automatically links an incoming OAuth identity with an existing account when email addresses match, assuming the OAuth provider has confirmed ownership of the address. The application controller relies on the boolean value `profile.EmailVerified` set by adapters of individual providers. Several adapters incorrectly populate this field: Discord silently omits the verification field returned by the provider API, Bitbucket accepts unverified email addresses and marks them as verified, while Microsoft adapters (AzureAD, EntraID) derive the email address from fields that do not confirm ownership (e.g., user principal name) and also mark it as verified. As a result, an attacker can present the victim's email address, cause OAuth identity to merge with the victim's account, and obtain a full authenticated session.

Impact

An attacker with no privileges can remotely and without interaction from the victim take full control of another user's account and obtain an authenticated session with access to their data.

Mitigation & patch

Update the Nhost auth package to version 0.49.1 or newer, which fixes the incorrect email verification logic in the mentioned OAuth adapters. Patch available in the Nhost GitHub repository (tag auth@0.49.1).

Who is affected

Nhost versions before 0.49.1 using OAuth adapters for Discord, Bitbucket, AzureAD, or EntraID.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X