CVE-2025-24856: Account Takeover Vulnerability in Causal OIDC Extension
Summary
CVE-2025-24856: TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc). Affects causal/oidc versions >= 3.0.0, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Causal OIDC extension for TYPO3 facilitates OpenID Connect authentication, allowing users to log in using their existing accounts from identity providers. This extension is widely used for enhancing user authentication processes in TYPO3 applications. However, it has a critical vulnerability that can lead to account takeover if exploited.
Vulnerability Detail
The vulnerability arises from a flaw in the account linking logic of the Causal OIDC extension. An attacker can exploit this flaw by anticipating a user's email address and registering a frontend user account with that email before the legitimate user logs in for the first time using OIDC. If the identity provider returns the email field containing the user's email address, the attacker can hijack the account, leading to unauthorized access and potential data breaches.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
composer require causal/oidc:4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the latest version of the extension as soon as possible.
Conclusion
The Causal OIDC extension has a significant vulnerability that can lead to account takeover if not addressed. Users are strongly advised to update to the latest version to protect their applications from potential attacks. Regular monitoring and updates are essential for maintaining security in open-source software.
See every vulnerability recorded for causal/oidc →
FAQ
The vulnerability allows an attacker to take over a user's account by exploiting the account linking logic in the Causal OIDC extension.
If you are using versions of the Causal OIDC extension prior to 4.0.0, your application is at risk. You can check your application's composer.lock file or use Vulert to monitor for vulnerabilities.
While there are no specific workarounds, it is crucial to prioritize updating the extension to mitigate the risk of account takeover.
The CVSS score for this vulnerability is 4.2, indicating a moderate severity level.
Vulert is a monitoring tool that uses the composer.lock file to alert users in real-time about open-source vulnerabilities. You can check if your application is affected by visiting the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for causal/oidc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
