mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
4fbcd6b2d6
Two findings from automated security review of the just-merged #6973 OIDC login gate: - HIGH: the allowlist matched the `email` claim without checking `email_verified`, so an attacker with an IdP account whose unverified email equals an allowlisted address could pass the gate. Now the email claim is only honored when email_verified === true. - MEDIUM: error redirects built their target from the raw Host header (reflected open-redirect). Now resolved against the framework-parsed request URL. Regression test added asserting an unverified allowlisted email is rejected.