CVE-2026-41574: 
vulnerability analysis and mitigation

CVE-2026-41574 is an OAuth email verification bypass vulnerability in Nhost (an open-source Firebase alternative with GraphQL) that allows unauthenticated attackers to take over existing user accounts. The flaw affects the nhost/auth service in all versions prior to 0.49.1. It was published on May 8, 2026, with the underlying fix merged on April 17, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is improper authentication (CWE-287) in Nhost's OAuth provider adapter layer. Nhost's providerFlowSignIn() controller in sign_in_id_token.go automatically links an incoming OAuth identity to an existing account when email addresses match, but never validates the profile.EmailVerified boolean before performing the link. Four specific provider adapters are vulnerable: (1) Discord — the discordUserProfile struct omits the verified field, causing Go's JSON decoder to silently drop it; the adapter then sets EmailVerified: email != "", which is always true when an email is present; (2) Bitbucket — correctly queries /user/emails for confirmed entries but falls back to unconfirmed emails and marks them verified; (3) AzureAD — derives the email from preferred_username or UPN (internal directory attributes that do not prove email ownership) and marks it verified; (4) EntraID — the entraidUser struct lacks an email_verified field, so the OIDC claim from Microsoft Graph is ignored and EmailVerified is set unconditionally (GitHub Advisory, Fix PR).

Successful exploitation results in full account takeover of any existing Nhost user without requiring any victim interaction. An attacker gains a fully authenticated session with the victim's account, enabling them to change the account email, disable other login methods, and permanently lock out the legitimate owner. The severity escalates to Critical in applications with administrative or privileged accounts, and the attack is silent — the victim receives no notification and the resulting session appears entirely legitimate (GitHub Advisory).

No weaponized exploit code or in-the-wild exploitation has been confirmed; the GitHub security advisory and fix PR serve as the primary public references but contain no executable exploit. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA KEV catalog. The attack requires no privileges, no user interaction, and is network-accessible, making it trivially exploitable by any attacker who can register an account with a vulnerable OAuth provider (Discord, Bitbucket, AzureAD, or EntraID) (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Nhost application that uses Discord, Bitbucket, AzureAD, or EntraID as an OAuth provider and has a known victim account email (e.g., admin@target.io).
2. Claim the victim's email on the OAuth provider: For Discord, navigate to User Settings → Account and change the account email to the victim's address (admin@target.io). Dismiss the dialog without clicking the confirmation link — the account now has "verified": false in Discord's API response.
3. Initiate OAuth sign-in: Visit the target Nhost application and click "Sign in with Discord" (or the relevant vulnerable provider).
4. Trigger the bypass: Nhost fetches the attacker's Discord profile. Because the discordUserProfile struct lacks the Verified field, Go's JSON decoder drops it. The adapter sets EmailVerified: true because "admin@target.io" != "".
5. Identity merge: Nhost's providerFlowSignIn() finds the victim's existing account by email match, sees no Discord provider row linked to it, and calls InsertUserProvider() to link the attacker's Discord identity — without ever checking EmailVerified.
6. Session issuance: Nhost issues a full authenticated session for the victim's account and returns it to the attacker, completing the account takeover (GitHub Advisory).

• Logs: Nhost auth service logs showing a new OAuth provider identity (e.g., Discord, Bitbucket, AzureAD, EntraID) being linked (InsertUserProvider) to an existing account from an unfamiliar IP address or at an unexpected time; log entries with "user found, signing in" immediately followed by a new provider insertion for an account that previously had no such provider linked.
• Auth Events: Unexpected new OAuth provider associations appearing in the auth.user_providers table for existing accounts, particularly for providers the user never configured.
• Session Anomalies: Authenticated sessions originating from new geographic locations or devices shortly after a new OAuth provider link event, with no corresponding user-initiated action.
• Account Changes: Post-compromise changes to account email address or disabling of existing authentication methods (password, MFA) by the attacker to lock out the legitimate owner (GitHub Advisory).

Upgrade the Nhost auth service to version 0.49.1 or later, released April 17, 2026. The fix introduces a tri-state EmailVerificationStatus (Verified, Unverified, Unknown) replacing the boolean, and adds an ensureProviderLinkAllowed() guard that rejects provider-to-account linking unless the provider explicitly attests email ownership. If immediate patching is not possible, consider temporarily disabling OAuth authentication for the affected providers (Discord, Bitbucket, AzureAD, EntraID) or restricting OAuth to providers that enforce server-side email verification. Audit the auth.user_providers table for unexpected provider links as a detection measure (GitHub Release, Fix PR).

The vulnerability was reported by security researcher skoveit and credited in the GitHub Security Advisory published by Nhost maintainer dbarrosop. A brief mention appeared on Bluesky via the CVE tracking account shortly after disclosure. Coverage was picked up by automated CVE aggregators (cvefeed.io, cve.report) and a technical write-up was published at infinitsec.net. No major vendor statements or widespread community debate have been observed beyond the GitHub advisory and fix PR (GitHub Advisory).