Executive brief
Nhost, an open-source backend platform, is vulnerable to a flaw that allows attackers to take over user accounts. By using third-party login services like Discord or Bitbucket with an unverified email address that matches a victim's account, an attacker can trick the system into granting them full access to that victim's data and sessions. This could lead to unauthorized access to sensitive information, data theft, or permanent lockout of legitimate users.
Technical details
An authentication bypass exists in Nhost's OAuth implementation where the system automatically merges identities based on email addresses without verifying that the email has been confirmed by the provider. The root cause is twofold: the central controller (`providerFlowSignIn`) fails to check the `EmailVerified` flag, and several provider adapters (Discord, Bitbucket, AzureAD, EntraID) incorrectly populate this flag by either ignoring provider-supplied verification status or falling back to unverified fields like UPN. An attacker can register an account with a target's email on a vulnerable provider, leave it unverified, and then use that provider to sign into Nhost, gaining a full authenticated session as the victim. A patch is available in version 0.0.0-20260417112436-ec8dab3f2cf4.
Affected products
- nhost nhost < 0.0.0-20260417112436-ec8dab3f2cf4
Timeline
- 2026-04-17: patched: Fixed in commit ec8dab3f2cf4
- 2026-04-17: advisory
- 2026-04-18: disclosed