starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-02-26 02:35:12 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Remove associate_by_email from the default social auth pipeline, which can allow for account takeovers #9156

New Issue
Closed
opened 2025-12-29 20:46:21 +01:00 by adam · 1 comment
adam commented 2025-12-29 20:46:21 +01:00
Owner
Copy Link

Originally created by @remram44 on GitHub (Jan 26, 2024).

Originally assigned to: @abhi1693 on GitHub.

NetBox version

>=3.1.0 including 3.7.1

Feature type

Change to existing functionality

Proposed functionality

The default social auth pipeline used by NetBox includes associate_by_email. This is disabled by default in social auth for security reasons as it allows account takeover. Let's disable it to match social auth's defaults.

Use case

associate_by_email automatically links a new social login with any existing account that has the same email address. For example, if you allow social auth via Google and I have the superuser's email on my Google account, when I log in via Google, I am let into that superuser account.

This is safe if you are using an SSO system that validates email addresses (e.g. your company's SSO) but usually NOT for social login. Many sites will report email addresses even though they have not yet been validated.

This affected me as I use CILogon (which in turns uses a large variety of providers). It famously affects Google accounts as well (source).

Database changes

No response

External dependencies

No response

Originally created by @remram44 on GitHub (Jan 26, 2024). Originally assigned to: @abhi1693 on GitHub. ### NetBox version \>=3.1.0 including 3.7.1 ### Feature type Change to existing functionality ### Proposed functionality The [default social auth pipeline](https://github.com/netbox-community/netbox/blob/v3.7.0/netbox/netbox/settings.py#L570-L581) used by NetBox includes `associate_by_email`. This is [disabled by default in social auth](https://python-social-auth.readthedocs.io/en/latest/use_cases.html#associate-users-by-email) for security reasons as it allows account takeover. Let's disable it to match social auth's defaults. ### Use case `associate_by_email` automatically links a new social login with any existing account that has the same email address. For example, if you allow social auth via Google and I have the superuser's email on my Google account, when I log in via Google, I am let into that superuser account. This is safe if you are using an SSO system that validates email addresses (e.g. your company's SSO) but usually NOT for social login. Many sites will report email addresses even though they have not yet been validated. This affected me as I use CILogon (which in turns uses a large variety of providers). It famously affects Google accounts as well ([source](https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of/)). ### Database changes _No response_ ### External dependencies _No response_
adam added the status: acceptedtype: feature labels 2025-12-29 20:46:21 +01:00
adam closed this issue 2025-12-29 20:46:21 +01:00
adam commented 2025-12-29 20:46:21 +01:00
Author
Owner
Copy Link

@remram44 commented on GitHub (Jan 26, 2024):

This was filed as a security advisory first, I am re-filing as feature request as per @jeremystretch's comment.

@remram44 commented on GitHub (Jan 26, 2024): This was filed as a security advisory first, I am re-filing as feature request as per @jeremystretch's comment.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9156
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?