AIKIDO-2026-511719
serverpod_auth_server is vulnerable to Authentication Bypass
93
Critical Risk
This Affects:
serverpod_auth_serverTL;DR
The legacy serverpod_auth Apple and Firebase sign-in endpoints establish identity without fully verifying the presented token. AppleEndpoint.authenticate checks only the RS256 signature and resolves the account by email, so any Apple developer can mint a token for a victim's email against Apple's shared JWKS and sign in as that account. FirebaseEndpoint.authenticate trusts the token's email claim without checking email_verified, so a self-registered unverified address can authenticate as an existing account created through password or Google. The fix validates Apple iss, aud, and exp/iat against configured client IDs and requires Firebase email_verified to be true.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment enables Sign in with Apple or Firebase sign-in through the legacy serverpod_auth module.
Background info
serverpod_auth_server is vulnerable to Authentication Bypass in versions 0.9.2 - 2.9.4 and 3.0.0 - 3.4.12.
How to fix this
Upgrade the serverpod_auth_server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.