{"items":[{"id":"NVI-00015085","kind":"vulnerability","title":"Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-29rf-f4vv-pvq6","CVE-2026-35511"],"plain_summary":"GitHub lists this reviewed advisory for github.com/authorizerdev/authorizer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1cf4e090c1f31c90eec490aaebe31805"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1cf4e090c1f31c90eec490aaebe31805","url":"https://github.com/advisories/GHSA-29rf-f4vv-pvq6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-29rf-f4vv-pvq6","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:16:47.162Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1cf4e090c1f31c90eec490aaebe31805"],"technology":"github.com/authorizerdev/authorizer","known_exclusions":[],"conditions_summary":"The OAuth callback handler links incoming OAuth identities (Google, GitHub, etc.) to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address (without verifying it) gains persistent password-based access to the victim's account after the victim completes a normal OAuth login. Verified against HEAD (commit 73679fa).\n\n## Root Cause\n\nIn `internal/http_handlers/oauth_callback.go`, when an OAuth login occurs for an email that already exists in the database:\n\nLine 125: The existing user is looked up by email:\n\n    existingUser, err := h.StorageProvider.GetUserByEmail(ctx, refs.StringValue(user.Email))\n\nLine 164: The OAuth user object is replaced with the existing user:\n\n    user = existingUser\n\nLines 173-176: The OAuth provider is appended to the existing user's signup methods:\n\n    signupMethod := existingUser.SignupMethods\n    if !strings.Contains(signupMethod, provider) {\n        signupMethod = signupMethod + \",\" + provider\n    }\n    user.SignupMethods = signupMethod\n\nLines 179-181: If the existing account's email was NOT verified, it is automatically v","public_affected_ranges":["< 0.0.0-20260807033110-66fe488fd2a4"]}],"null_published_at":"2026-11-03T10:03:26.546Z","source_updated_at":"2026-08-14T15:36:17.000Z","source_disclosed_at":"2026-08-14T15:36:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:16:47.162Z"}],"next_cursor":null,"snapshot_revision":"42594"}