9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41574

CVE-2026-41574: Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41574

CVE-2026-41574:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nhost/nhost	go	< 0.0.0-20260417112436-ec8dab3f2cf4	0.0.0-20260417112436-ec8dab3f2cf4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical account takeover flaw within Nhost's authentication flow. The root cause is a combination of issues in the OAuth provider integrations and the central sign-in controller. Several OAuth provider adapters (Discord, Bitbucket, AzureAD, EntraID) incorrectly determined the email verification status. They either ignored explicit verification flags from the provider, used insecure fallbacks, or simply assumed an email was verified if it was present. This incorrect verification status was then consumed by the providerFlowSignIn function, which trusted the boolean and proceeded to link the OAuth identity to an existing Nhost account if the email addresses matched. This allowed an attacker to create an account on an external OAuth provider with a victim's email address, and without verifying it, sign into the Nhost application and take over the victim's account. The patch addresses this by implementing stricter checks in the central controller (providerFlowSignIn) to require explicit email verification before linking accounts, and by fixing the individual provider adapters to correctly report the verification status.

Vulnerable functions

Controller.providerFlowSignIn

services/auth/go/controller/sign_in_id_token.go

This function is the central logic for handling OAuth sign-ins. The vulnerability lies in the fact that before the patch, it would link a new provider identity to an existing user account based on a matching email address without verifying if the email provided by the OAuth provider was actually verified. This allowed an attacker to create an OAuth account using a victim's email, and without verifying it, take over the victim's Nhost account. The patch introduces a call to `ensureProviderLinkAllowed` which explicitly checks the email verification status.

Discord.GetProfile

services/auth/go/providers/discord.go

This function fetches a user's profile from Discord. The vulnerability is that the `discordUserProfile` struct was missing the `Verified` field from Discord's API response. Consequently, the function incorrectly assumed an email was verified if it was simply present (`userProfile.Email != ""`), allowing an attacker to use an unverified email for an account takeover. The patch adds the `Verified` field to the struct and uses its value to determine the email verification status.

Bitbucket.GetProfile

services/auth/go/providers/bitbucket.go

This function fetches a user's profile from Bitbucket. The vulnerability was in a fallback mechanism that used an unconfirmed email address if no confirmed primary email was found. It then incorrectly marked this unconfirmed email as verified. An attacker could add a victim's email to their Bitbucket account, not confirm it, and exploit this flaw. The patch removes this fallback logic entirely.

AzureAD.GetProfile

services/auth/go/providers/azuread.go

This function fetches a user's profile from AzureAD. The vulnerability was that it used fields like `preferred_username` and `User Principal Name (UPN)` as fallbacks for the email address. These fields do not prove ownership of the email address. The function then incorrectly marked the email as verified, leading to a potential account takeover. The patch removes this insecure fallback logic.

EntraID.GetProfile

services/auth/go/providers/entraid.go

This function fetches a user's profile from EntraID. The vulnerability was that it ignored the `email_verified` claim provided by the OIDC provider and instead assumed the email was verified if it was present. This allowed an attacker with an unverified email to be treated as verified. The patch corrects this by using the `email_verified` field from the provider.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.