GHSA-mh6w-2cch-w8v8: Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Databasement versions before 1.10.9 are affected where OIDC authentication can supply an identity with an email matching a local account. Any local account matched this way, including the super-admin account, may be targeted.
What does an attacker need to exploit it?
The attacker does not need an existing Databasement account or user interaction. They need to register or control an identity-provider account that presents the target user's email address without that email being verified.
Can password resets remove an attacker's access?
No. The vulnerability description states that an attacker can retain access after password resets because the OIDC identity has been linked to the local user account.
What is the immediate mitigation if upgrading is not possible?
The provided data does not specify a workaround. The underlying issue is acceptance of OIDC email identities without checking email_verified, so deployments should treat OIDC email-based auto-linking as unsafe until updated to 1.10.9 or later.