TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
Impact
A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met:
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 3.0.0 before 4.0.0Ecosystem versions | 4.0.0 |
Version evidence: OSV · GHSA-hj78-p4h7-m5fv
View original version evidence (1 explicit versions)
Original source description
Problem Description
A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met:
- An attacker can anticipate the email address of the user.
- An attacker can register a public frontend user account using that email address before the user's first OIDC login.
- The IDP returns the field email containing the email address of the user
Solution
An updated versions 4.0.0 is available from the TYPO3 extension manager, packagist and at https://extensions.typo3.org/extension/download/oidc/4.0.0/zip
Users of the extension are advised to update the extension as soon as possible.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-24856
- Patch github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/causal/oidc/CVE-2025-24856.yaml
- Security advisory typo3.org/security/advisory/typo3-ext-sa-2025-001