GitHub Advisoryadvisory · Packagist

GHSA-hj78-p4h7-m5fv TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

MEDIUM Published 2025-01-28 Modified 2025-03-17 Official page ↗
Aliases
CVE-2025-24856
Ecosystem
Packagist
Packages
causal/oidc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-288, CWE-348, CWE-639
Reviewed
2025-01-28

Affected packages

• Packagist causal/oidc: >= 3.0.0, < 4.0.0 → fixed in 4.0.0

Description

Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: • An attacker can anticipate the email address of the user. • An attacker can register a public frontend user account using that email address before the user's first OIDC login. • The IDP returns the field email containing the email address of the user Solution An updated versions 4.0.0 is available from the TYPO3 extension manager, packagist and at https://extensions.typo3.org/extension/download/oidc/4.0.0/zip Users of the extension are advised to update the extension as soon as possible.

Related

Alias · CVE (1)

  • CVE-2025-24856 An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. vulnerability

Weakness · CWE (3)

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
  • CWE-348 Use of Less Trusted Source weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References