Outline、SSO連携でアカウント乗っ取りの恐れ 1.11.0で修正

Vulnerability Details

File: server/commands/userProvisioner.ts
Line: 76-114
CWE: CWE-287 — Improper Authentication
Severity: Critical
CVSS: 9.1 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Root Cause

userProvisioner() looks up an existing UserAuthentication record purely by providerId (the external user ID reported by whichever OAuth/OIDC provider is being used, e.g. a Google sub claim, a Slack member ID, a Discord snowflake, or a custom OIDC sub) and team:

const auth = authentication
  ? await UserAuthentication.findOne({
      where: { providerId: String(authentication.providerId) },
      include: [{ model: User, as: "user", where: { teamId }, required: true }],
    })
  : undefined;

if (auth && authentication) {
  const { user } = auth;

  // We found an authentication record that matches the user id, but it's
  // associated with a different authentication provider... Auto-migrate to the new provider.
  if (auth.authenticationProviderId !== authenticationProviderId) {
    await auth.update({ authenticationProviderId });
  }

  if (user) {
    if (emailVerified === true) {
      await user.update({ email });
    }
    await auth.update(rest);
    return { user, authentication: auth, isNewUser: false };
  }
}

providerId values are only guaranteed unique within their own provider's namespace — nothing in the code or database guarantees uniqueness across different provider types. I confirmed directly: the actual DB…