Fortify OAuth Account Takeover: Bypassing Password+2FA via Unverified Email Binding (CWE-287)

Key Vulnerability Information Summary Vulnerability Overview Type: OAuth account takeover vulnerability (Authentication Bypass) Mechanism: The resolves the local account via and directly calls . It does not validate the provider's verified-email binding table, allowing an attacker to use a victim's email address (with password, verified email, and 2FA enabled) to log in directly during the OAuth callback, thereby bypassing the password and 2FA. Verification Method: Using a victim account (password + verified email + 2FA enabled) and simulating a GitHub profile with , the attacker successfully logs in as the victim via without being challenged for 2FA. Impact Scope Affected Components: The OAuth login path ( , where the Fortify pipeline is bypassed at ). Impact: If an attacker knows the victim's email address, they can take over the account (including admin accounts) on sites configured with that provider, bypassing both the password and 2FA. CWE: CWE-287, CWE-8.4 (Coalfish 8.4 + Coalfish dependency). Notes: Existing recommendations only cover the OAuth security path; the GitHub repository for verified emails is in an open untracked feature, and no fix has been released yet. Remediation (Recommendations) 1. Enforce validation of the provider's . 2. Introduce an binding table and perform matching during the OAuth callback (explicitly confirming the binding relationship). 3. Force-enable 2FA within the OAuth path. 4. A PoC is available. POC / Exploitation Code Disclosure Timeline 2026-03-13: Reported via email 2026-07-19: Follow-up email

Goal Reached Thanks to every supporter — we hit 100%!

Fortify OAuth Account Takeover: Bypassing Password+2FA via Unverified Email Binding (CWE-287)

More from this source