GHSA-433w-mm6h-rv9p Auth bypass in SAML provider
Attackers can bypass authentication in applications using the vulnerable SAML provider, potentially gaining unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-433w-mm6h-rv9p?
GHSA-433w-mm6h-rv9p is an authentication bypass vulnerability in github.com/netlify/gotrue, published on 23 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:
Patches
Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90
Workarounds
No known workarounds.
For more information
If you have any questions or comments about this advisory:
- Open an issue in gotrue
- Email us at [email protected]
Which versions are affected by GHSA-433w-mm6h-rv9p?
2 open source packages ship an affected version, including github.com/netlify/gotrue.
| Package | Affected | Fixed in |
|---|---|---|
github.com/netlify/gotrue Go | All versions | 1.0.0 |
github.com/netlify/gotrue Go | All versions | 1.0.0 |
How do I fix GHSA-433w-mm6h-rv9p?
Upgrade github.com/netlify/gotrue to 1.0.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-433w-mm6h-rv9p being exploited?
There is no known exploitation of GHSA-433w-mm6h-rv9p in the wild and no public exploit code.