GitHub sign-in only claims a verified email (account takeover) - #432
Merged
Merged
Conversation
GitHub is registered with allowDangerousEmailAccountLinking, which trusts the email to be the user's own. Auth.js's GitHub provider, when the profile has no public email, takes the primary (or first) address from /user/emails without checking verified. Someone could add a member's address to their own GitHub account, never verify it, keep it private, and sign in with GitHub straight into that member's account, admin roles included. Production wires both GitHub secrets, so this was live. The provider now overrides userinfo.request: it always reads /user/emails and uses the verified primary, else any verified address, else none (the sign-in then has no email and fails). verifiedGitHubEmail is tested, and packages/auth joins the root test run.
aamoghS
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug (security)
GitHub is registered with
allowDangerousEmailAccountLinking: true, which trusts the email to be the user's own. Auth.js's GitHub provider, when the profile has no public email, takes the primary (or first) address from/user/emailswithout checkingverified.So someone could add a member's address to their own GitHub account, never verify it, keep it private, and sign in with GitHub straight into that member's account, admin roles included.
apphosting.yamlwires both GitHub secrets, so this is live in production.Fix
The provider overrides
userinfo.request: always read/user/emailsand use the verified primary, else any verified address, else none (sign-in then has no email and fails).Tests
verifiedGitHubEmailunit tests (verified primary wins; unverified primary never taken; none verified → null).packages/authadded to the rootpnpm test. Typecheck 9/9, lint 8/8, 831 tests pass.Worth doing after merge
Check
accountrows withprovider = 'github'whose linked user's email isn't a verified address on that GitHub account; a takeover would look like that.