Executive brief
Authorizer is an open-source authentication service that handles user login and account management. The system fails to verify email ownership before linking OAuth identities (Google, GitHub, etc.) to existing accounts. An attacker can pre-register an account with a victim's email address without verifying it, then when the victim legitimately logs in via OAuth, the attacker's unverified account gets the OAuth identity linked to it—and the attacker's original password remains valid, giving them permanent backdoor access to the victim's account and all associated data.
Technical details
The vulnerability is an authentication bypass in the OAuth callback handler (internal/http_handlers/oauth_callback.go). When an OAuth login occurs for an email that already exists in the database, the system links the incoming OAuth identity to the existing account without verifying that the email was previously verified by its original owner. Specifically: (1) the callback looks up an existing user by email, (2) replaces the OAuth user object with the existing user, (3) appends the OAuth provider to the signup methods, and (4) automatically marks the email as verified if it was not already verified. Critically, the attacker's original password is never invalidated or changed. An unauthenticated attacker can exploit this by pre-registering with the victim's email address, setting a known password, and deliberately not verifying the email. When the real email owner later logs in via OAuth (a normal, expected action), the attacker's unverified account is silently upgraded and the attacker retains password-based access even after OAuth is revoked. This is a zero-click attack from the victim's perspective. The patch requires verification that an existing account's email is already verified before linking it to an OAuth identity, and recommends invalidating existing passwords when linking new OAuth identities.
Affected products
- Authorizer Authorizer < 0.0.0-20260807033110-66fe488fd2a4
Timeline
- 2026-08-14: disclosed: Published as GHSA-29rf-f4vv-pvq6 / CVE-2026-35511
- 2026-08-14: patched: Fixed in version 0.0.0-20260807033110-66fe488fd2a4 (2.4.0-rc.16)