VYPR
← All advisories
High severityNVD Advisory· Published Sep 2, 2022· Updated Apr 22, 2025

Account takeover via SSO plugins in NodeBB

CVE-2022-36076

Description

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NodeBB SSO vulnerability allows MITM account takeover due to nonce check becoming opt-in; patched in v1.17.2.

Root

Cause The vulnerability stems from an unnecessarily strict conditional in the code handling the first step of the SSO process. This inadvertently made the nonce addition and validation logic opt-in instead of opt-out, effectively disabling a critical security check that was meant to prevent replay attacks [1][4].

Exploitation

An attacker with a Man-in-the-Middle (MITM) position could craft a valid SSO authorization code for their own account and then trick a victim into visiting a crafted URL (e.g., via CSRF) that associates the victim's account with the attacker's SSO provider. This process requires no user interaction beyond the victim being logged into NodeBB and visiting the malicious link [3].

Impact

Successful exploitation allows an attacker to take over a victim's NodeBB account, gaining full access to the victim's forum privileges, including administrative rights if the victim is an admin [3][4].

Mitigation

The issue has been fully patched in NodeBB version 1.17.2. Site maintainers are advised to upgrade immediately or cherry-pick the fix commit a2400f6 into their codebase [4].

References
  1. NVD - CVE-2022-36076
  2. Bug Bounty Adventures: A NodeBB 0-day
  3. Account takeover via SSO plugins (via shared link to /auth/callback with valid code)

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nodebbnpm
< 1.17.21.17.2

Affected products

2
  • ghsa-coords
    pkg:npm/nodebb
    Range: < 1.17.2
  • NodeBB/NodeBBv5
    Range: < 1.17.2

Patches

1
a2400f6baff4

fix: accidental unnecessarily strict conditional that effectively rendered SSO state checking opt-in instead of opt-out

https://github.com/NodeBB/NodeBBJulian LamJun 14, 2021via ghsa
commit
1 file changed · +1 −1
  • src/routes/authentication.js+1 −1 modified
    @@ -104,7 +104,7 @@ Auth.reloadRoutes = async function (params) {
 					prompt: strategy.prompt || undefined,
 				};
 
-				if (strategy.checkState) {
+				if (strategy.checkState !== false) {
 					req.session.ssoState = req.csrfToken && req.csrfToken();
 					opts.state = req.session.ssoState;
 				}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.