Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in Capgo's application, which uses Supabase, allowing unauthorized users to bypass single sign-on (SSO) controls. This bypass could enable the assertion of attacker-controlled SSO for arbitrary domains, potentially disrupting normal login processes.
- Unauthorized SSO bypass is possible.
- Bypassed SSO could disrupt user access.
- Confirm relevance and exposure of SSO controls.
Attack Path
How an attacker could exploit the issue
An attacker with a Capgo full API key can directly write to a sensitive table, bypassing security checks designed to prevent unauthorized SSO provisioning. This allows them to assert control over SSO for any domain, disrupting normal login processes.
- Requires an API key.
- Inserts a row into a table.
- Enables attacker-controlled SSO.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an ordinary Capgo API key holder could insert a row into the `public.sso_providers` table, bypassing intended backend provisioning controls. This could lead to attacker-controlled SSO enforcement for arbitrary domains, disrupting normal login flows by making unauthenticated endpoints incorrectly report that SSO is enabled and enforced.
- System data, user authentication data
- Direct API write access bypass
- Disrupted user login, unauthorized SSO enforcement
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in Capgo affects all versions due to direct write access to the public.sso_providers table via Supabase PostgREST, allowing unauthorized SSO enforcement. Initial actions should focus on identifying all instances of the affected technology, determining their reachability and business criticality, and locating the accountable owner for coordinated remediation.
- Application and platform teams should own.
- Verify external exposure and critical systems.
- Plan remediation considering vendor coordination.
