Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Vulnerability

In Microweber versions prior to 1.2.15, the registration process lacks email confirmation, and social login does not validate whether an account already exists for the provided email. This allows an attacker to create an account using a victim's email address, effectively taking over the victim's account pre-authentication [1][4].

Exploitation

An attacker only needs the victim's email address. By registering a new account with that email, no confirmation is required, granting the attacker immediate access. Additionally, social login can be used to link an existing social account to the victim's email without checking for an existing account, further enabling account takeover [1][4].

Impact

Successful exploitation gives the attacker full control of the victim's account. The attacker can view all activities (confidentiality breach), modify or corrupt data (integrity impact), and potentially disrupt availability. The victim may remain unaware of the takeover [1][4].

Mitigation

The vulnerability is fixed in Microweber version 1.2.15. Users should upgrade to this version or later. No workaround is available other than updating [1].