Horizon Alert
Summary of the vulnerability and why it matters
This Nhost vulnerability allows an attacker to link an unverified email address to an existing account. This could enable them to gain authenticated access to another user's account without proper verification.
- Unauthenticated access to accounts.
- Compromised user data and sessions.
- Attackers can exploit unverified emails.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by tricking a user into initiating an OAuth login with a provider where the email verification is flawed. This allows the attacker to associate their own email with the victim's Nhost account, gaining authenticated access. The attacker needs no prior access, just the ability to prompt a user through a specific OAuth flow.
- Unauthenticated attacker target.
- Flawed OAuth provider adapters.
- Victim must initiate login.
Live Threat
Current exploitation, exposure, and threat context
Attackers will find this vulnerability attractive due to its potential for account takeover, allowing them to impersonate users by linking their own OAuth identity to an existing account. The ease of exploitation, requiring only an email address and the ability to manipulate OAuth provider responses, makes it a compelling target for automated attacks or targeted campaigns. This vulnerability impacts the core authentication mechanism, creating a direct path to unauthorized access.
- Exploitable via OAuth identity linking.
- Allows unauthorized account access.
- Affects authentication flow.
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Nhost versions prior to 0.49.1 immediately due to the critical risk of unauthorized account access. If patching is delayed, isolate affected services to prevent exploitation.
- Upgrade Nhost to version 0.49.1.
- Block suspicious OAuth login attempts.
- Monitor for account takeovers.
