Capgo SSO Identity Merge Bypass Leading to Account Takeover via Email Assertion

Vulnerability Overview Title: Cross-Domain SSO Email Assertion Allows Account Takeover via Identity Merge in Description: Summary: The SSO user configuration merge path in transfers SSO identities and removes duplicate accounts based solely on email address matching, without verifying whether the authenticated SSO provider is authorized for the victim's email domain. If an attacker controls a malicious Identity Provider (IdP), they can forge a SAML assertion containing any victim's email address, triggering the merge flow and gaining full access to the victim's account. Details: - When a user authenticates via SSO and an existing account with the same email is found, the code enters the merge path. - The critical flaw is that the lookup only fails in mode and does not block the merge. - The merge path does not verify if the SSO provider matches the victim's email domain, only proving ownership of the attacker's domain. Impact Scope Full Account Takeover: An attacker with an enterprise plan organization and a malicious IdP can take over any Capgo account by forging email addresses in SAML assertions. Cross-Organizational Boundary Violation: The attacker's SSO provider (limited to ) can assert emails for any domain, breaking implicit domain isolation. Data Exposure: Complete rewriting of access permissions to victim organization, application, channel, bundle, and device data. Cascading Access: If the victim is an administrator in other organizations, the attacker inherits these access privileges. Remediation Recommended Fix: The merge path should abort if no valid SSO provider exists, matching the behavior of the non-merge path. Add domain authorization checks to ensure: 1. Merging only occurs when a valid, active SSO provider exists. 2. The authenticating provider is the same one registered for that domain. POC Code Prerequisites: The attacker has an enterprise plan organization, administrative access, and has configured an SSO provider for (DNS verified and activated). Steps: 1. Configure Attacker's IdP: Set up a local SimpleSAML instance to generate a SAML assertion containing . 2. Initiate SSO Login via Attacker's Provider: Browser redirected to the attacker's IdP. 3. Attacker's IdP Returns Signed SAML Response: Asserts . Supabase Auth validates the signature and creates a new row. 4. Call provision-user Endpoint: Automatically called after SSO login. 5. Merge Path Activated: - Searches for existing row. - Searches for row but fails (no provider exists). - Logs a warning and proceeds. - Transfers attacker's SSO identity to the victim's account. - Deletes the attacker's duplicate record. 6. Attacker Logs In Again via Their IdP: The SSO identity now points to the victim's original account, granting the attacker full access.

Goal Reached Thanks to every supporter — we hit 100%!

Capgo SSO Identity Merge Bypass Leading to Account Takeover via Email Assertion

More from this source