Flowise Cross-IdP Account Takeover via Email-Only SSO Matching

Vulnerability Summary: Cross-IdP Account Takeover via Email-Only SSO Matching Vulnerability Overview Vulnerability Type: Cross-Identity Provider (Cross-IdP) Account Takeover Root Cause: Flowise uses only the field as the unique identifier to match or create users during SSO login, ignoring the (Identity Provider) information. Attack Principle: 1. An attacker registers with their own SSO account (e.g., Google) using an email address identical to the victim's email address. 2. When the victim attempts to log in using their SSO account (e.g., GitHub), the system detects that the email address already exists. 3. The system incorrectly associates the victim's login request with the account previously created by the attacker. This results in the victim actually logging into the attacker's account, or the attacker being able to take over the victim's account. Impact Scope Affected Versions: Affected Component: SSO Login Logic ( ) Severity: Critical Remediation Fixed Version: Fix Measure**: The field has been introduced into the user matching logic. The system now checks the combination of and , ensuring that accounts from different identity providers are not conflated simply because they share the same email address. POC Code The page contains the following POC code, demonstrating how an attacker can exploit this vulnerability: ```typescript // POC: SSO email-only identity binding (cross-provider account merge) // // Replays the verbatim user-resolution path from: // packages/server/src/enterprise/src/sso/sso.service.ts:138-148 (verifyAndLogin) // packages/server/src/enterprise/src/services/account.service.ts:537-590 (login) // in a self-contained simulator. // --- Constants --- const UserStatus = Object.freeze({ ACTIVE: 'active', INVITED: 'invited', UNVERIFIED: 'unverified', DELETED: 'deleted', }); // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schemas/user.schema.ts) --- const users: Array = []; // --- Verbatim port of UserSchema (packages/server/src/enterprise/src/schem

Goal Reached Thanks to every supporter — we hit 100%!

Flowise Cross-IdP Account Takeover via Email-Only SSO Matching

More from this source