Executive Summary

This vulnerability exists in the AAP gateway's user auto-link strategy introduced in AAP 2.6. It automatically links an external Identity Provider (IDP) identity to an existing AAP user account based solely on matching email addresses without verifying that the user actually owns the email. Because of this, a remote attacker can manipulate the IDP-provided email to hijack a victim's account or gain unauthorized access to other accounts, including administrative ones.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to user accounts, including administrative accounts, by allowing attackers to hijack accounts through email manipulation. This can result in compromised data, unauthorized actions within the system, and potential disruption of services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a remote attacker to hijack user accounts or gain unauthorized access, including to administrative accounts, by exploiting the automatic linking of external Identity Provider identities without verifying email ownership.

Such unauthorized access could lead to exposure or misuse of sensitive personal or health information, potentially violating data protection regulations such as GDPR or HIPAA that require strict access controls and protection of personal data.

Therefore, this flaw could negatively impact compliance with these standards by undermining the confidentiality and integrity of protected data.

Useful 0 Not Useful 0