Authentication bypass in vector-admin domain restriction
Description
Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: 0
Patches
Vulnerability mechanics
Root cause
"The domain restriction check used `String.includes()` instead of extracting and comparing the exact email domain, allowing registration with email addresses that merely contain the restricted domain as a substring."
Attack vector
An attacker can register an account on a vector-admin server that has "domain restriction" enabled without owning an authorized email address. The original check used `email.includes(domainRestriction.value)`, which only verified that the restricted domain string appeared anywhere in the email address. An attacker could bypass this by registering with an email like `attacker@evil.com` when the restriction is set to `evil.com`, or even `attacker@allowed.com.evil.com` since `includes` would match a substring. [ref_id=1]
Affected code
The vulnerability resides in the authentication endpoint of vector-admin, specifically in the domain restriction check during user registration. The patch modifies the logic in `function authenticationEndpoints(app)` where the `email.includes(domainRestriction.value)` check was replaced with a proper domain extraction and comparison using `email.substring(email.lastIndexOf("@") + 1)` and `emailDomain !== domainRestriction.value`.
What the fix does
The patch replaces the loose `email.includes(domainRestriction.value)` check with a precise domain extraction and strict equality comparison. The new code extracts the domain portion after the last `@` symbol using `email.substring(email.lastIndexOf("@") + 1)` and then checks `emailDomain !== domainRestriction.value`. This ensures only email addresses whose domain exactly matches the configured restriction are accepted, preventing registration with unauthorized domains. [ref_id=1]
Preconditions
- configThe vector-admin server must have the 'account_creation_domain_scope' setting enabled with a domain restriction value configured.
- networkThe attacker must have network access to the vector-admin registration endpoint.
- authNo authentication is required; the attacker can be unauthenticated.
Generated on Jun 12, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.