OAuth Identity Linking Issue in Nhost Open Source Platform

CVE-2026-41574

What is CVE-2026-41574?

Nhost, an open-source platform designed to be an alternative to Firebase, has a significant vulnerability related to its OAuth integration. Prior to version 0.49.1, the system automatically linked incoming OAuth identities to existing accounts if the email addresses matched. This mechanism relies on the assumption that the email has been verified by the OAuth provider. However, several provider adapters fail to consistently validate this assumption. For instance, providers like Discord may discard the verification status while others, such as Bitbucket, incorrectly treat unconfirmed emails as verified. Furthermore, certain Microsoft identity providers derive email addresses from fields that do not confirm ownership, leading to potential security breaches where an attacker could link their OAuth identity to a victim's account without authorization. This critical flaw has been addressed in the recent version 0.49.1, highlighting the importance of rigorous email verification in OAuth workflows.

References