AIKIDO-2026-424388
serverpod_auth_idp_server is vulnerable to Authentication Bypass
85
High Risk
This Affects:
serverpod_auth_idp_serverTL;DR
The GoogleIdpBaseEndpoint.login endpoint accepts an optional Google access token alongside the ID token, but validates the access token without binding it to the verified ID token identity. Any valid Google access token, including one minted for a different OAuth client, is accepted, so a token holder can create or take over an account for a victim identity. Applications using the Google provider with clients that send access tokens, the default for Flutter clients with non-empty scopes, are exposed. The fix treats the verified ID token as the authoritative identity and requires the userinfo sub to match.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable Google sign-in with clients that send an access token.
Background info
serverpod_auth_idp_server is vulnerable to Authentication Bypass in versions 3.0.0 - 3.4.11.
How to fix this
Upgrade the serverpod_auth_idp_server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.