| शीर्षक | chillzhuang springblade v4.0 and later Authorization Bypass Through User-Controlled SQL Primary Key |
|---|
| विवरण | The HTTP endpoint POST /user/user-auth-info accepts a client-supplied userId and persists it together with an OAuth subject identified by uuid and source.
An attacker can bind an OAuth identity they control to any victim account, including administrative accounts. During a subsequent OAuth login using that same identity, the application resolves the attacker-controlled OAuth identity to the victim account, causing the authentication service to issue a valid authentication token for the victim.
The endpoint is implemented as a REST controller intended for Feign-based service communication, but it lacks:
- Service-to-service authentication
- Authorization checks
- Current-user validation
- Ownership validation
As a result, it can be abused to create arbitrary OAuth-to-user account associations. |
|---|
| स्रोत | ⚠️ https://aibot88.github.io/CVERequest/SpringBlade/issue2.html |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 30/07/2026 06:15 AM (2 महीनों पहले) |
|---|
| संयम | 24/09/2026 03:58 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409352 [chillzhuang SpringBlade तक 5.0.2 user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo userId अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|