InsForge: OAuth account takeover via unverified email

No upstream patch is available yet. Self-hosted InsForge operators should apply a mitigation or disable affected third-party OAuth providers until an official fix is released.

1. Disable OAuth providers that allow unverified email claims (such as Discord) in your InsForge authentication settings if password sign-in is also enabled.
2. If modifying self-hosted code, patch backend/src/services/auth/auth.service.ts so findOrCreateThirdPartyUser only links to an existing account when the provider identity explicitly asserts email_verified: true.
3. Do not automatically mark email_verified = true on pre-existing local accounts during third-party OAuth linking unless ownership was verified by the provider.

Any local user account created with email and password, or created via another verified provider, can be taken over by an attacker who registers that same email address on a third-party OAuth provider where email verification is not strictly enforced.

Upon completing the OAuth flow, the backend links the attacker's third-party identity to the victim's local account row in auth.users, flips email_verified = true, and issues a valid authenticated access token for the victim. The takeover requires no victim interaction and leaves no indication in the user interface. A working exploit is withheld.

In backend/src/services/auth/auth.service.ts, findOrCreateThirdPartyUser checks whether a user already exists with the normalized email returned by the OAuth provider. If found, it inserts a link into auth.user_providers and issues an access token immediately:

• Finding by email and auto-linking: backend/src/services/auth/auth.service.ts#L925-L945
• Marking email verified and issuing token: backend/src/services/auth/auth.service.ts#L946-L960
• Discord adapter extracts email without checking verification status: backend/src/providers/oauth/discord.provider.ts#L156-L163
• GitHub adapter falls back to unverified primary or list emails: backend/src/providers/oauth/github.provider.ts#L154-L164

1. 2026-07-10Vulnerability reported privately via GitHub Security Advisory (GHSA-2xrr-5x8x-fchx).
2. 2026-08-12First follow-up comment posted on the advisory (33 days in triage).
3. 2026-08-29Second follow-up comment posted on the advisory (7 weeks in triage).
4. 2026-09-17Third follow-up comment posted on the advisory (69 days in triage).
5. 2026-10-09Coordinated-disclosure notice posted on the advisory, setting a 21-day deadline to 2026-10-30.
6. 2026-10-30Coordinated-disclosure deadline expired with no response from the maintainer; sink verified still present at HEAD 21ce31d.
7. 2026-11-02Public advisory published; CVE requested via MITRE CNA-LR.

• Affected repository: InsForge/InsForge
• GitHub Security Advisory: GHSA-2xrr-5x8x-fchx (private; in triage)