Diego Rodrigues de Sa e Souza 4fbcd6b2d6 fix(security): harden OIDC callback — require email_verified for allowlist + safe error redirects ...

Two findings from automated security review of the just-merged #6973 OIDC login gate:
- HIGH: the allowlist matched the `email` claim without checking `email_verified`, so
  an attacker with an IdP account whose unverified email equals an allowlisted address
  could pass the gate. Now the email claim is only honored when email_verified === true.
- MEDIUM: error redirects built their target from the raw Host header (reflected
  open-redirect). Now resolved against the framework-parsed request URL.

Regression test added asserting an unverified allowlisted email is rejected.

2026-07-19 23:33:44 -03:00

16 KiB

Raw Permalink Blame History

View Raw