CVE-2025-24856
mediumpriority · track · 0OT risk · elevatedEPSS 0.002 · 8 %ileDEEUUSEPSS · scored 2026-10-27
An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: (1) an attacker can anticipate the e-mail address of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's first OIDC login, and (3) the IDP returns an email field containing the e-mail address of the user,
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.9–4.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0210TYPO3 "oidc" Extension: Schwachstelle ermöglicht Erlangen von BenutzerrechtenDeutsch2025-01-28csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in TYPO3´s "oidc" Extension ausnutzen, um Benutzerrechte zu erlangen.
- GHSA-hj78-p4h7-m5fvTYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)2025-01-28ghsa · osvUS
## Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: - An attacker can anticipate the email address of the user. - An attacker can register a public frontend user account using that email address before the user's first OIDC login. - The IDP returns the field email containing the email address of the user ## Solution An updated versions 4.0.0 is available from the TYPO3 extension manager, packagist and at https://extensions.typo3.org/extension/download/oidc/4.0.0/zip Users of the extension are advised to update the extension as soon as possible.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-24856cnnvd
- https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-24856cnnvd
- https://typo3.org/security/advisory/typo3-ext-sa-2025-001cnnvd
- https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3enisa_euvd
- https://typo3.org/security/advisory/typo3-ext-sa-2025-001enisa_euvd
- https://github.com/xperseguers/t3ext-oidc/commit/877e09f6faf4c87bbb41233112ec7e30d3c902b3nvd
- https://typo3.org/security/advisory/typo3-ext-sa-2025-001nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan