Description

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T22:16:52.930Z",
  "pubdate": "2026-08-18T22:16:52.930Z",
  "executiveSummary": "4gaBoards prior to version 3.3.8 is susceptible to a pre-account takeover vulnerability.\nThe vulnerability allows an unauthenticated attacker to register a local account using a victim's email address.\nWhen specific registration and Single Sign-On (SSO) configurations are enabled, the application fails to verify local account ownership before linking verified SSO identities.\nAffected systems include 4gaBoards prior to version 3.3.8 with registrationEnabled, localRegistrationEnabled, ssoRegistrationEnabled, and Google, GitHub, Microsoft, or OIDC SSO configured.\nThe impact results in unauthorized account linkage, enabling attackers to retain password access, access victim projects, internal data, and permissions upon the victim's subsequent SSO login.\nAttacker capabilities include creating unverified accounts and seizing control of victim identities upon legitimate SSO authentication events.\nExploitation requires registration features and supported SSO mechanisms to be simultaneously enabled on the target instance.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure account linkage logic within SSO processing helpers and improper handling of unverified local accounts during authentication flows.\nVulnerable components include the POST /api/register endpoint, the POST /api/access-tokens endpoint, and specific SSO helper scripts: server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js.\nAffected versions comprise all 4gaBoards deployments prior to version 3.3.8.\nNetwork exposure is inherent to standard web application interfaces accessible via HTTP/HTTPS endpoints for registration and authentication.\nAuthentication requirements for the initial account creation phase are none, as unauthenticated attackers can interact with the registration API.\nPrivilege requirements are absent for the initial trigger, but successful exploitation yields standard user privileges over the hijacked account.\nThe attack flow proceeds as follows: First, the attacker sends a request to the POST /api/register endpoint utilizing a victim's email address while registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are active. This action successfully provisions an unverified local account associated with the victim's email.\nSecond, the attacker leverages the POST /api/access-tokens endpoint to authenticate against this unverified local account while isVerified remains false.\nThird, when the legitimate victim subsequently attempts their first SSO login using Google, GitHub, Microsoft, or OIDC SSO, the respective helper scripts (server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, or server/api/helpers/users/get-create-one-for-oidc-sso.js) query existing users by email address.\nFourth, the application matches the victim's SSO login email to the pre-existing attacker-controlled local account and links the verified external SSO identity to it without confirming ownership or requiring email verification of the local account.\nPost-exploitation impact allows the attacker to maintain persistent local-password access alongside the linked SSO identity, granting sustained unauthorized access to the victim's projects, sensitive data, and associated permissions."
}