CVE-2025-24856 TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
Attackers can hijack accounts by pre-registering with a victim's email before their first OIDC login, requiring specific IDP email return conditions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-24856?
CVE-2025-24856 is a medium-severity vulnerability in TYPO3 oidc, published on 16 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: (1) an attacker can anticipate the e-mail address of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's first OIDC login, and (3) the IDP returns an email field containing the e-mail address of the user,
Weakness: CWE-348
Which versions are affected by CVE-2025-24856?
2 open source packages ship an affected version, including causal/oidc.
| Package | Affected | Fixed in |
|---|---|---|
causal/oidc Packagist | From 3.0.0 | 4.0.0 |
causal/oidc Packagist | From 3.0.0 | 4.0.0 |
How do I fix CVE-2025-24856?
Upgrade causal/oidc to 4.0.0 or later.
Is CVE-2025-24856 being exploited?
There is no known exploitation of CVE-2025-24856 in the wild and no public exploit code.
Sources
Also known as GHSA-hj78-p4h7-m5fv.