Security: OIDC email linking
Version 0.23.3 introduces verified-email-only linking for OIDC identities. To enable this protection, upgrade and set OIDC_TRUST_EMAIL=false in your deployment environment, then restart/redeploy WYGIWYH. The adapter preserves case-insensitive matching for existing local email addresses.
For compatibility with #518 and previously documented behavior, OIDC_TRUST_EMAIL defaults to true. This trusts all emails supplied by your configured issuer, even when email_verified is false or missing. Upgrading alone does not disable unconditional trust. If your issuer lets an attacker claim another user's email without verifying ownership, this mode can allow takeover of that local account, including an administrator account. Only retain unconditional trust with an issuer that guarantees email ownership.
Deployments without OIDC are not exposed to this OIDC linking path. Potentially affected operators should review existing linked social identities, remove unauthorized links, and revoke affected sessions; the new setting does not undo existing links or sessions.
Thanks to @tonghuaroot for reporting the issue and providing a proof of concept.
Advisory: GHSA-prgm-wrjv-fvrh
Implementation: #615
What's Changed
- feat(automatic-exchange-rates): add FXMacroData as a provider by @roberttidball in #611
- build(deps): bump django from 5.2.16 to 5.2.17 by @dependabot[bot] in #609
- build(deps): bump pyjwt from 2.13.0 to 2.15.0 by @dependabot[bot] in #608
- build(deps): bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #610
- build(deps): bump anyio from 4.13.0 to 4.14.2 by @dependabot[bot] in #606
- build(deps): bump soupsieve from 2.8.4 to 2.9 by @dependabot[bot] in #605
- Stop exposing exception text in OAuth dynamic client registration errors by @eitchtee with @Copilot in #569
- feat(transactions): convert a transaction into a quick transaction, recurring transaction or installment plan by @eitchtee in #613
- feat: add Simulator tool by @eitchtee in #614
- feat(auth): make OIDC email trust configurable by @eitchtee in #615
- fix(automatic-exchange-rates): don't follow redirects or log the key in the FXMacroData provider by @roberttidball in #612
- build: upgrade to Python 3.14 by @eitchtee in #616
- build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend by @dependabot[bot] in #617
- fix(simulator): use money mask on amount field by @eitchtee in #618
New Contributors
- @roberttidball made their first contribution in #611
- @eitchtee with @Copilot made their first contribution in #569
Full Changelog: 0.23.2...0.23.3