Threats tagged 'ghsa-29rf-f4vv-pvq6'

A vulnerability in Authorizer's OAuth callback handler allows an attacker to take over user accounts without user interaction by exploiting unverified email accounts. The system links OAuth identities to existing accounts matched by email without verifying the email was originally verified by the account owner. This flaw enables an attacker who pre-registers an account with a victim's email (unverified) to gain persistent password access after the victim logs in via OAuth. The attacker’s password remains valid and the victim is not notified of the linked OAuth identity.