CVE-2026-41574 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
Attackers can take over user accounts by exploiting OAuth email verification bypasses in Nhost's identity linking logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41574?
CVE-2026-41574 is a critical authentication bypass vulnerability in nhost, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1.
Weakness: CWE-287
Which versions are affected by CVE-2026-41574?
3 open source packages ship an affected version, including github.com/nhost/nhost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nhost/nhost Go | All versions | 0.0.0-20260417112436-ec8dab3f2cf4 |
github.com/nhost/nhost Go | All versions | 0.0.0-20260417112436-ec8dab3f2cf4 |
github.com/nhost/nhost Go | All versions | 0.0.0-20260417112436-ec8dab3f2cf4 |
Products include Nhost Nhost\/Auth.
How do I fix CVE-2026-41574?
Upgrade github.com/nhost/nhost to 0.0.0-20260417112436-ec8dab3f2cf4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-41574 being exploited?
There is no known exploitation of CVE-2026-41574 in the wild and no public exploit code.
Other vulnerabilities in nhost
Sources
Also known as GHSA-6g38-8j4p-j3pr, GO-2026-5176.