CVE Intelligence
Analysis AI-assisted

CVE-2026-41574: Nhost OAuth Email Verification Bypass Leading to Account Takeover

Nhost, an open source Firebase alternative, automatically links an incoming OAuth identity to an existing account when email addresses match, which is only safe when the provider has verified the email. Several provider adapters set the verification flag incorrectly, so an attacker may be able to take over an account using an unowned email address. The record states the issue is fixed in 0.49.1.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Nhost is an open source Firebase alternative built on GraphQL. According to the record, Nhost automatically links an incoming OAuth identity to an existing account when the email addresses match. This is only safe when the provider has verified the email, and several provider adapters set that verification flag incorrectly. The weakness is classified as CWE-287 (Improper Authentication).

Impact

  • An attacker may be able to sign in to a victim's Nhost account by presenting an email address they do not control through an affected OAuth provider.
  • The record describes the result as a full authenticated session.
  • The NVD base score is 9.8 (critical). The record also lists a score of 9.3 from the GitHub CNA.

Affected products and versions

  • Nhost Nhost: versions before 0.49.1.
  • Nhost Nhost/auth: versions before 0.49.1.
  • The fix is listed as 0.49.1 in the record.
  • The record names the Discord, Bitbucket, AzureAD and EntraID provider adapters as the components involved.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record, so no active exploitation is recorded there.
  • No confirmed exploitation appears in the sources consulted. The SSVC data in the record lists exploitation as none.
  • The EPSS probability in the record is 0.00905.

Remediation and mitigation

  • Upgrade the Nhost components to 0.49.1 or later, as indicated by the GitHub advisory and the release notes.
  • Review the patch commit to understand the changes to provider adapters.
  • If an upgrade cannot be applied immediately, review which OAuth providers are enabled and whether automatic account linking by email is in use. This is an inference from the mechanism and is not a workaround stated by the vendor.
  • Review accounts linked through OAuth providers for unexpected identity associations.

Detection guidance

  • Review authentication logs for OAuth sign-ins that link to existing accounts, especially through Microsoft or Bitbucket identities.
  • Look for sessions created for accounts whose owners did not start the linking.
  • These are high-level checks. The record does not describe specific log fields.

Limitations of the available information

  • The record gives no version boundary beyond the 0.49.1 fix.
  • The reference list includes entries tagged Exploit. Their contents were not reviewed, and the tag is not confirmation of exploitation.
  • The record does not show whether the scores or EPSS data have been updated since publication.

Frequently asked questions

What is the core problem in CVE-2026-41574?

Nhost links an OAuth identity to an existing account when emails match, but some provider adapters wrongly mark unverified emails as verified, so the link can be made without proof of email ownership.

Which versions are affected?

The record lists Nhost and Nhost auth as affected before 0.49.1, and 0.49.1 is the fixed version.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade to 0.49.1 or later, review linked OAuth accounts and enabled providers, and check authentication logs for unexpected linking.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.