OAuth Session Establishment in Concrete CMS Prior to 9.5.3

Executive Summary

Concrete CMS OAuth callback login path prior to version 9.5.3 did not verify if an account was active or email-validated before creating a session. This allowed deactivated or unvalidated users with existing OAuth bindings to authenticate and receive a fully authenticated session.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Concrete CMS OAuth callback login path not validating active or email-validated accounts before establishing sessions. Detection requires checking Concrete CMS version and OAuth callback configurations. Review server logs for suspicious OAuth callback attempts or unexpected session establishments from deactivated/unvalidated users.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to a Concrete CMS account even if the account was deactivated or unvalidated. This could lead to data breaches, unauthorized actions, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and user authentication, such as GDPR's data protection principles or HIPAA's access control safeguards. Unauthorized access risks non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the OAuth callback login path vulnerability. Review and disable OAuth bindings for deactivated or unvalidated accounts. Monitor login events and session establishments for suspicious activity.

Useful 0 Not Useful 0