Executive brief
Chatwoot is a customer engagement platform used by businesses to manage communications with their clients. A security flaw in its login system allowed attackers to take over a user's account before the legitimate owner even signed up. By pre-registering a victim's email address, an attacker could maintain access to the account even after the real owner logged in via Google or other social login providers, potentially exposing sensitive customer data and private communications.
Technical details
A Pre-Account Takeover (Pre-ATO) vulnerability exists in Chatwoot's authentication flow due to improper verification of email ownership during the registration and OAuth linking process. An attacker can register an account using a victim's email address and set a password without completing email confirmation. When the legitimate owner later signs in using an OmniAuth provider (like Google), the system silently confirms the existing account but fails to invalidate the attacker's previously set password. This allows the attacker to continue accessing the account using their credentials even after the victim has populated it with sensitive data. The vulnerability is fixed in version 4.13.0 by rotating the stored password to a random value whenever an unconfirmed user completes an OAuth sign-in.
Affected products
- Chatwoot Chatwoot >= 2.14.0, < 4.13.0
Timeline
- 2026-03-23: other: Fix pull request submitted
- 2026-04-02: patched: Fix merged into develop branch
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD