Overview
CVE-2026-35511 is a critical vulnerability in Authorizer, a popular authentication and authorization platform. This vulnerability allows an attacker to perform a zero-click account takeover by linking an OAuth identity to an unverified email account. In this analysis, we will delve into the root cause of the vulnerability, walk through an exploitation scenario, and provide recommendations for detection and defense.
Understanding the Vulnerability / Threat
Root Cause Analysis
The vulnerability lies in the OAuth callback handler, specifically in the `internal/http_handlers/oauth_callback.go` file. When an OAuth login occurs for an email that already exists in the database, the existing user is looked up by email, and the OAuth user object is replaced with the existing user. The OAuth provider is then appended to the existing user's signup methods. If the existing account's email was not verified, it is automatically verified. However, the existing account's password is not invalidated or the owner notified that a new OAuth identity was linked.
This vulnerability belongs to the CWE-639 category, which involves 'Authorization Bypass Through User Agent'. The root cause is a trust boundary violation, where Authorizer correctly trusts that Google has verified the email address but incorrectly extends that trust to validate the password set by the unverified attacker.
Attack Surface & Vector
The attack surface is the OAuth callback handler, which is accessible remotely. An attacker can exploit this vulnerability by pre-registering with a victim's email address without verifying it. The attacker can then gain persistent password-based access to the victim's account after the victim completes a normal OAuth login.
Exploitation Mechanics — Scenario Walkthrough
Scenario: Compromising a Corporate Authorizer Instance
1.
Initial Position: An attacker signs up with `
[email protected]` using email/password, setting a known password but not clicking the email verification link.
2.
Triggering the Flaw: The real owner of `
[email protected]` logs in via Google OAuth, a completely normal action. The OAuth callback finds the attacker's existing account by email and links the Google OAuth identity to the attacker's account.
3.
What Breaks: The email is automatically verified, and the account now has both "basic_auth" and "google" as valid login methods. The attacker's original password is still valid in the database.
4.
Attacker's Prize: The attacker logs in with `
[email protected]` and the password they originally set, gaining full access to the victim's account, including any data the victim added via their Google session.
Real-World Impact
The impact of this vulnerability is severe. An attacker can perform a zero-click account takeover, gaining persistent password-based access to the victim's account. This allows the attacker to access all data the victim creates after OAuth login, and the victim has no indication their account was pre-staged. This vulnerability affects every OAuth provider configured in Authorizer, including Google, GitHub, Facebook, Apple, LinkedIn, Twitter, Discord, Twitch, Roblox, and Microsoft.
Detection & Defense
Immediate Mitigations
To mitigate this vulnerability, it is recommended to upgrade to the latest version of Authorizer, which includes a fix for this issue. Additionally, users should verify that their email addresses are verified and that they have not linked any unverified email accounts to their OAuth identities.
Detection Strategies
Defenders can detect exploitation attempts by monitoring for suspicious login activity, such as multiple login attempts from different IP addresses or locations. They can also monitor for changes to account settings, such as the addition of new OAuth identities or email addresses.
Long-Term Hardening
To prevent this class of vulnerability, it is recommended to implement additional security measures, such as:
* Verifying the existing account's email before linking an OAuth identity
* Invalidating any existing password on the account or requiring the user to re-authenticate via the original method
* Implementing additional authentication factors, such as multi-factor authentication
* Regularly reviewing and updating account settings and OAuth identities
Key Takeaways
* CVE-2026-35511 is a critical vulnerability in Authorizer that allows for zero-click account takeover via OAuth identity linking to unverified email accounts.
* The vulnerability is caused by a trust boundary violation, where Authorizer incorrectly extends trust to validate the password set by the unverified attacker.
* Defenders can detect exploitation attempts by monitoring for suspicious login activity and changes to account settings.
* To prevent this class of vulnerability, it is recommended to implement additional security measures, such as verifying the existing account's email before linking an OAuth identity and invalidating any existing password on the account.
Sources
* GitHub Security Advisories: https://github.com/advisories/GHSA-29rf-f4vv-pvq6