Authentication Bypass in Databasement via OAuth Email Spoofing

Executive Summary

Databasement before version 1.10.9 has an authentication bypass flaw in OAuthService::findOrCreateLocalUser(). It links OIDC identities to local users by email without checking if the email is verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including super-admin, and retain access even after password resets.

Useful 0 Not Useful 0

Detection Guidance

Check Databasement version with: curl -s https://your-databasement-instance/version | grep version. If version is before 1.10.9, the system is vulnerable. Review OAuth logs for unusual login attempts or account links by email without verification.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of your Databasement instance, access stored database credentials, manage volumes, and perform administrative actions. Even if you reset your password, the attacker's OIDC identity remains linked to your account, allowing continued unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches and lack of proper authentication controls.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Databasement to version 1.10.9 or later immediately.
• Disable auto-linking by email in OAuth settings or set OAUTH_AUTO_LINK_BY_EMAIL=false.
• Ensure email_verified claim is required for OIDC logins and providers without this claim are blocked.
• Review and remove any unauthorized OIDC identities linked to admin accounts.

Useful 0 Not Useful 0