Nhost accepts an OAuth identity that claims an email address and trusts a boolean 'EmailVerified' supplied by the OAuth provider. Several provider adapters mistakenly set this flag to true—even when the email is unverified—allowing an attacker to present any email they want and have that email linked to a victim’s Nhost account. When the identities are merged, the attacker receives a fully authenticated session with the victim’s privileges. This vulnerability is a classic Authentication Bypass (CWE-287).

The affected product is Nhost (an open‑source Firebase alternative using GraphQL) from the vendor nhost. All versions released before 0.49.1 contain the flaw; version 0.49.1 and later incorporate the fix.

The CVSS score of 9.3 indicates a critical severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires control over the OAuth flow—specifically, the attacker must obtain an OAuth token for an email that the provider claims is verified. With this token, the attacker can initiate a login to Nhost, causing the service to link the attacker’s unverified email to the target account. Appropriate prerequisites include use of an OAuth provider whose adapter fails to properly validate EmailVerified. The vulnerability can be exploited remotely over the internet and can lead to full account compromise.