-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-allauth | pip | < 65.13.0 | 65.13.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the django-allauth library's providers for Okta and NetIQ. Specifically, the extract_uid method in both the OktaProvider and NetIQProvider classes was using the preferred_username attribute from the identity provider's response as the unique identifier for a user's social account. The preferred_username is often configurable by the user and can be changed, making it a mutable identifier. An attacker could exploit this by changing their preferred_username to match that of a victim, potentially allowing them to take over the victim's account within the application. The patch addresses this by changing the extract_uid method to use the sub (subject) claim instead. The sub claim is a standard, immutable identifier in OpenID Connect and OAuth 2.0, which guarantees uniqueness and prevents such impersonation attacks. The vulnerable functions are allauth.socialaccount.providers.netiq.provider.NetIQProvider.extract_uid and allauth.socialaccount.providers.okta.provider.OktaProvider.extract_uid because they directly processed the mutable identifier.
allauth.socialaccount.providers.netiq.provider.NetIQProvider.extract_uidallauth/socialaccount/providers/netiq/provider.py
allauth.socialaccount.providers.okta.provider.OktaProvider.extract_uidallauth/socialaccount/providers/okta/provider.py