Chatwoot’s authentication flow allowed an attacker who had pre‑registered an email address without confirming it to set a password. When the legitimate owner later signed in with an OmniAuth provider such as Google, the OAuth flow silently confirmed the account without invalidating the attacker’s pre‑set credentials. The attacker could then log in with the original password and access any data the victim entered, including PII, API keys, and other sensitive information. This is a pre‑account takeover vulnerability that effectively bypasses authentication and relies on CWE‑283 and CWE‑287 weaknesses.

The vulnerability affects the Chatwoot customer‑engagement suite from version 2.14.0 up to, but not including, 4.13.0. All releases in that range that use the default authentication flow are susceptible.

The CVSS score of 6.8 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the current exploit trend is unclear. The likely attack vector is the public account‑registration interface; an attacker only needs the ability to register an email address and set a password. Once the legitimate owner authenticates via OAuth, the account is automatically confirmed, allowing the attacker to retain its password and access the account. This makes exploitation realistic and straightforward for an adversary with access to a web browser and an email address they control.