[PR #7163] [MERGED] Several SSO Fixes #37028

New Issue

Closed

opened 2026-07-13 21:32:36 -05:00 by GiteaMirror · 0 comments

GiteaMirror commented 2026-07-13 21:32:36 -05:00

Owner

Copy Link

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/7163
Author: @BlackDex
Created: 4/29/2026
Status: ✅ Merged
Merged: 4/29/2026
Merged by: @dani-garcia

Base: main ← Head: sso-fixes

---

📝 Commits (4)

• 9296b24 Ensure SSO token is only usable on the same client
• 45c2611 Check email-verified on SSO login/create
• 40beb2e Prevent data disclosure via SSO endpoints
• 9393f94 Adjust admin layout to fix issues when SSO is enabled

📊 Changes

20 files changed (+125 additions, -47 deletions)

View changed files

➕ migrations/mysql/2026-04-25-120000_sso_auth_binding/down.sql (+1 -0)
➕ migrations/mysql/2026-04-25-120000_sso_auth_binding/up.sql (+1 -0)
➕ migrations/postgresql/2026-04-25-120000_sso_auth_binding/down.sql (+1 -0)
➕ migrations/postgresql/2026-04-25-120000_sso_auth_binding/up.sql (+1 -0)
➕ migrations/sqlite/2026-04-25-120000_sso_auth_binding/down.sql (+1 -0)
➕ migrations/sqlite/2026-04-25-120000_sso_auth_binding/up.sql (+1 -0)
📝 src/api/core/organizations.rs (+12 -30)
📝 src/api/identity.rs (+66 -5)
📝 src/crypto.rs (+7 -0)
📝 src/db/models/sso_auth.rs (+9 -1)
📝 src/db/schema.rs (+1 -0)
📝 src/sso.rs (+2 -1)
📝 src/sso_client.rs (+2 -1)
📝 src/static/scripts/admin.css (+13 -2)
📝 src/static/templates/admin/base.hbs (+1 -1)
📝 src/static/templates/admin/diagnostics.hbs (+1 -1)
📝 src/static/templates/admin/login.hbs (+1 -1)
📝 src/static/templates/admin/organizations.hbs (+1 -1)
📝 src/static/templates/admin/settings.hbs (+1 -1)
📝 src/static/templates/admin/users.hbs (+2 -2)

📄 Description

Several SSO fixes

Ensure SSO token is only usable on the same client

This commit adds an extra check via cookies to ensure the same browser/client is used to request and provide the SSO token.
Previously it would be able to provide a custom link which attackers could use to steal data.
While an attacker would still need the Master Password to be able to decrypt or execute specific actions, they were able to fetch encrypted data.

Check email-verified on SSO login/create

This commit prevents possible account takeover via SSO which doesn't check/validate or provide validated status of the email.
It was checked at other locations, but was skipped here.

Prevent data disclosure via SSO endpoints

This commit prevents some data disclosure and user enumeration by only returning the fake SSO identifier.
Since we do not check the identifier anywhere useful, returning the fake one is just fine.

During an invite to an org, that link contains the correct UUID and will be used for the master password requirements.
For anything else, server admins should set the SSO_MASTER_PASSWORD_POLICY env variable.

Misc

Adjust admin layout to fix issues when SSO is enabled

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7163 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 4/29/2026 **Status:** ✅ Merged **Merged:** 4/29/2026 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `sso-fixes` --- ### 📝 Commits (4) - [`9296b24`](https://github.com/dani-garcia/vaultwarden/commit/9296b24c434eedac61a3154c32750d42a11674ea) Ensure SSO token is only usable on the same client - [`45c2611`](https://github.com/dani-garcia/vaultwarden/commit/45c26113ffe9bc07e2a30ec23a3c3702c93922f5) Check email-verified on SSO login/create - [`40beb2e`](https://github.com/dani-garcia/vaultwarden/commit/40beb2e695568052e1a4b8ad4459ab2321dd3fad) Prevent data disclosure via SSO endpoints - [`9393f94`](https://github.com/dani-garcia/vaultwarden/commit/9393f946f89c6fe68362d459475e421b164c7ef8) Adjust admin layout to fix issues when SSO is enabled ### 📊 Changes **20 files changed** (+125 additions, -47 deletions) <details> <summary>View changed files</summary> ➕ `migrations/mysql/2026-04-25-120000_sso_auth_binding/down.sql` (+1 -0) ➕ `migrations/mysql/2026-04-25-120000_sso_auth_binding/up.sql` (+1 -0) ➕ `migrations/postgresql/2026-04-25-120000_sso_auth_binding/down.sql` (+1 -0) ➕ `migrations/postgresql/2026-04-25-120000_sso_auth_binding/up.sql` (+1 -0) ➕ `migrations/sqlite/2026-04-25-120000_sso_auth_binding/down.sql` (+1 -0) ➕ `migrations/sqlite/2026-04-25-120000_sso_auth_binding/up.sql` (+1 -0) 📝 `src/api/core/organizations.rs` (+12 -30) 📝 `src/api/identity.rs` (+66 -5) 📝 `src/crypto.rs` (+7 -0) 📝 `src/db/models/sso_auth.rs` (+9 -1) 📝 `src/db/schema.rs` (+1 -0) 📝 `src/sso.rs` (+2 -1) 📝 `src/sso_client.rs` (+2 -1) 📝 `src/static/scripts/admin.css` (+13 -2) 📝 `src/static/templates/admin/base.hbs` (+1 -1) 📝 `src/static/templates/admin/diagnostics.hbs` (+1 -1) 📝 `src/static/templates/admin/login.hbs` (+1 -1) 📝 `src/static/templates/admin/organizations.hbs` (+1 -1) 📝 `src/static/templates/admin/settings.hbs` (+1 -1) 📝 `src/static/templates/admin/users.hbs` (+2 -2) </details> ### 📄 Description ## Several SSO fixes ### Ensure SSO token is only usable on the same client This commit adds an extra check via cookies to ensure the same browser/client is used to request and provide the SSO token. Previously it would be able to provide a custom link which attackers could use to steal data. While an attacker would still need the Master Password to be able to decrypt or execute specific actions, they were able to fetch encrypted data. ### Check email-verified on SSO login/create This commit prevents possible account takeover via SSO which doesn't check/validate or provide validated status of the email. It was checked at other locations, but was skipped here. ### Prevent data disclosure via SSO endpoints This commit prevents some data disclosure and user enumeration by only returning the fake SSO identifier. Since we do not check the identifier anywhere useful, returning the fake one is just fine. During an invite to an org, that link contains the correct UUID and will be used for the master password requirements. For anything else, server admins should set the `SSO_MASTER_PASSWORD_POLICY` env variable. ### Misc Adjust admin layout to fix issues when SSO is enabled --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2026-07-13 21:32:36 -05:00

GiteaMirror closed this issue 2026-07-13 21:32:37 -05:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

revert-7033-patch-1

cached-config-operations

test_dylint

1.36.0

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No Label pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#37028