Attack Chain

1. The attacker registers a new account on an Authorizer instance using the target's email address (victim@company.com) and a password known only to the attacker.
2. The attacker intentionally ignores the email verification prompt, leaving the account in the database with EmailVerifiedAt = nil.
3. The victim, unaware of the pre-staged account, logs in to the platform using a legitimate third-party OAuth provider (e.g., Google or GitHub).
4. The OAuth callback handler processes the request and identifies that an account with victim@company.com already exists in the local database.
5. The application merges the OAuth identity into the attacker's account, updating the SignupMethods field to include the provider.
6. The application logic automatically verifies the account's email address (EmailVerifiedAt is set to the current timestamp), trusting the OAuth identity without validating ownership.
7. The application saves the merged user state to the database, leaving the attacker's initial password intact and valid.
8. The attacker authenticates to the account using the email and their original password, successfully performing an account takeover.

Impact

Successful exploitation allows an attacker to achieve full account takeover. The attacker maintains persistent password-based access to the victim's account regardless of whether the victim later revokes the OAuth linkage. This leads to unauthorized data access and the potential for long-term credential abuse across all configured OAuth providers supported by Authorizer, including Google, GitHub, Facebook, and Microsoft.

Recommendation

Prioritized actions for security and platform engineering teams:

• Update all Authorizer instances to version 0.0.0-20260807033110-66fe488fd2a4 or later immediately.
• Review database logs for accounts where EmailVerifiedAt was updated automatically via an OAuth callback flow to identify potentially compromised accounts.
• If immediate patching is not possible, disable OAuth identity linking and require re-authentication via the primary password method to ensure account ownership.
• Audit all user accounts for inconsistencies in SignupMethods or unexpected verification timestamps that coincide with OAuth login events.