Summary
The OIDC login flow contains two authentication flaws.
- The authorize endpoint builds a post-login callback URL from the unvalidated
desktopCallbackPort query parameter. The callback decides whether to append the session token using a string prefix check instead of validating the parsed URL host. A crafted value can therefore redirect a victim newly issued Termix token to an attacker-controlled host.
- When ID-token signature verification throws, the login flow falls back to decoding the JWT payload and trusts the unverified claims. Those claims drive user identity and admin-group synchronization.
Affected component
src/backend/database/routes/users.ts
Impact
The callback issue allows an unauthenticated attacker to take over the account of a victim who completes OIDC login through an attacker-crafted authorize link. The verification fallback can accept forged identity or group claims if an attacker can supply a forged ID token while causing the normal verification path to fail.
Remediation
Validate the callback port as an integer from 1 through 65535, restrict callbacks to known origins, and base callback decisions on the parsed hostname. Never use decoded but unverified ID-token claims; reject login whenever signature, issuer, audience, nonce, or key verification fails.
jxnnyo Reporter
Summary
The OIDC login flow contains two authentication flaws.
desktopCallbackPortquery parameter. The callback decides whether to append the session token using a string prefix check instead of validating the parsed URL host. A crafted value can therefore redirect a victim newly issued Termix token to an attacker-controlled host.Affected component
src/backend/database/routes/users.tsImpact
The callback issue allows an unauthenticated attacker to take over the account of a victim who completes OIDC login through an attacker-crafted authorize link. The verification fallback can accept forged identity or group claims if an attacker can supply a forged ID token while causing the normal verification path to fail.
Remediation
Validate the callback port as an integer from 1 through 65535, restrict callbacks to known origins, and base callback decisions on the parsed hostname. Never use decoded but unverified ID-token claims; reject login whenever signature, issuer, audience, nonce, or key verification fails.