GHSA-9wgg-m99q-hhfc: 
Python vulnerability analysis and mitigation

A high severity vulnerability (GHSA-9wgg-m99q-hhfc) was discovered in the email-oauth2-proxy package affecting versions <= 2023.11.18. The vulnerability allowed expired OAuth 2.0 client credentials grant (CCG) flow authorization tokens to be renewed automatically without validating against the original account configuration. The issue was present from September 5, 2022 (commit 8c874c2) until it was patched in version 2023.12.19. The vulnerability has a CVSS score of 8.1, indicating high severity (GitHub Advisory).

The vulnerability stems from the proxy's token retrieval implementation, which was originally designed for interactive processes. When CCG tokens approached their expiry date or had expired, and the original unencrypted client_secret value was available, they were automatically reset and renewed without verifying the password's ability to decrypt the existing token. This issue specifically affects the OAuth 2.0 client credentials grant (CCG) flow, which is an administrator-level method that grants broad access without user interaction or remote account password verification (GitHub Advisory).

An attacker with knowledge of valid account addresses could potentially gain unauthorized access to accounts by timing their login attempts within 10 minutes prior to token expiry and before a legitimate login request. This impact is particularly significant in publicly-accessible deployments where the proxy is available from the internet or across a network. The vulnerability affects confidentiality and integrity with high severity, though availability remains unaffected (GitHub Advisory).

Users should upgrade to version 2023.12.19 or later which contains the fix. For those using the CCG flow, setting encrypt_client_secret_on_first_use = True and removing the original client_secret value from the proxy's configuration file provides protection against this vulnerability. The issue does not affect normal interactive account authentication or ROPCG flow users (GitHub Release).