Nhost
Monthly
Authentication bypass in Nhost (open-source Firebase alternative) allows account takeover via OAuth email verification bypass. Attackers can claim a victim's email address on vulnerable OAuth providers (Discord, Bitbucket, AzureAD, EntraID) without verification, then authenticate to Nhost and receive a full session merged into the victim's existing account. The flaw affects multiple OAuth provider adapters that incorrectly populate the EmailVerified field - Discord silently drops the API's verified flag, Bitbucket accepts unconfirmed emails as verified, and Microsoft providers derive emails from non-ownership-proving fields like user principal names. Patched in version 0.49.1 per GitHub Security Advisory GHSA-6g38-8j4p-j3pr. No public exploit identified at time of analysis, but attack is trivially executable given the detailed technical disclosure.
Nhost CLI MCP server before version 1.41.0 allows cross-origin requests without authentication when explicitly configured to listen on a network port, enabling malicious websites to invoke privileged tools using developer credentials. The vulnerability requires two explicit non-default configuration steps and does not affect the default configuration, significantly limiting real-world exposure.
Authentication bypass in Nhost (open-source Firebase alternative) allows account takeover via OAuth email verification bypass. Attackers can claim a victim's email address on vulnerable OAuth providers (Discord, Bitbucket, AzureAD, EntraID) without verification, then authenticate to Nhost and receive a full session merged into the victim's existing account. The flaw affects multiple OAuth provider adapters that incorrectly populate the EmailVerified field - Discord silently drops the API's verified flag, Bitbucket accepts unconfirmed emails as verified, and Microsoft providers derive emails from non-ownership-proving fields like user principal names. Patched in version 0.49.1 per GitHub Security Advisory GHSA-6g38-8j4p-j3pr. No public exploit identified at time of analysis, but attack is trivially executable given the detailed technical disclosure.
Nhost CLI MCP server before version 1.41.0 allows cross-origin requests without authentication when explicitly configured to listen on a network port, enabling malicious websites to invoke privileged tools using developer credentials. The vulnerability requires two explicit non-default configuration steps and does not affect the default configuration, significantly limiting real-world exposure.