peertube-plugin-auth-openid-connect: Account Takeover by E-Mail Change
Peertube uses the e-mail address as the primary and only identification factor when relating external OpenID Connect identities to local accounts. This results in a possible account takeover if the OIDC provider allows changing the e-mail address.
Using the e-mail address alone means that if the authentication provider allows changing the e-mail address of an account, the Peertube account can immediately be hijacked.
In OpenID Connect, the only field ever used to reliably identify a user is the sub
field (OIDC subject), as laid out by the OpenID Connect Basic Client Implementer's Guide:
The sub (subject) and iss (issuer) Claims, used together, are the only Claims that an RP can rely upon as a stable identifier for the End-User, since the sub Claim MUST be locally unique and never reassigned within the Issuer for a particular End-User, as described in Section 2.2. Therefore, the only guaranteed unique identifier for a given End-User is the combination of the iss Claim and the sub Claim.
All other Claims carry no such guarantees across different issuers in terms of stability over time or uniqueness across users, and Issuers are permitted to apply local restrictions and policies. For instance, an Issuer MAY re-use an email Claim Value across different End-Users at different points in time, and the claimed email address for a given End-User MAY change over time. Therefore, other Claims such as email, phone_number, and preferred_username and MUST NOT be used as unique identifiers for the End-User.
All users logging in through OIDC are affected. The severity is medium, as it also requires the OIDC provider to misbehave.
However, some well-known OIDC providers (like Microsoft Azure) make it very easy to accidentally allow unverified e-mail changes. Moreover, OpenID Connect also allows dybamic client registration. Ideally, at some point, Peertube instances should allow login using an arbitrary OIDC identifier connected to a user via Webfinger. Although Peertube does not allow this right now, the issue should be solved before it at some point does.