Ivantsepp

An issue exists when registration is enabled and the `[oauth2 client].ACCOUNT LINKING` setting is configured as `auto`. The link-account sign-up form identifies existing accounts to link based on the username or email provided in the form rather than the identity verified by the OAuth2 provider. This allows an attacker with a valid account on a configured OAuth2 provider to submit another user's name, link their external identity to that account, and gain unauthorized access without a password, potentially including administrative privileges. This link remains active for subsequent logins.

The issue arises due to default CORS settings in Nuxt, allowing any website to send requests to the development server and read the response. This can lead to source code theft by malicious websites, especially for users with the default `server.cors` option using Vite builder. The vulnerability can be exploited even if the development server is only accessible locally and not exposed to the network. There are three main causes: permissive default CORS settings, lack of validation on the Origin header for WebSocket connections, and lack of validation on the Host header for HTTP requests. These can allow attackers to steal source code, access functionalities not meant to be exposed, and exploit certain plugin functionalities.

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This issue is caused by three factors: permissive default CORS settings, lack of validation on the Origin header for WebSocket connections, and lack of validation on the Host header for HTTP requests. Attackers can exploit these vulnerabilities to steal source code, access functionalities not supposed to be exposed externally, and exploit functionalities triggered by messages over WebSocket.