The flaw occurs when FileRise accepts OIDC claims for the preferred_username or email that are mutable and do not require email verification. An attacker who can supply provider‑issued claims that match an existing local username can authenticate as that user, including the built‑in administrator, even when automatic provisioning is disabled. This results in an authentication bypass and grant of full access to the victim account. The weakness is a classic authentication bypass (CWE‑287) with related weaknesses in improper access control (CWE‑290) and reliance on unvalidated data (CWE‑345).

FileRise, a self‑hosted web‑based file manager, is affected. Versions prior to 3.23.0 map OIDC identities directly to local accounts using mutable preferred_username or email claims without requiring email verification. The vulnerability can be exercised against any deployment of FileRise that has an OIDC identity provider configured to issue colliding claims. Post‑3.23.0 releases are unaffected because the mapping logic has been altered.

The CVSS score is 8.1, indicating high severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The attack vector relies on an OIDC provider that accepts custom or colliding identity claims; the attacker must control or forge the provider’s payloads. When such a provider is used, the authorizing server can bind an attacker’s identity to an existing local account with no further authentication. Because the flaw bypasses all standard credential checks, the potential impact is total loss of confidentiality and integrity of the affected account. The exploitability is limited to deployments that use OIDC providers lacking enforcement of unique, verified identity claims.