Release 2.52.0: Merge Bugfix into Dev #13601
Merged
DryRunSecurity / General Security Analyzer
succeeded
Nov 3, 2025 in 1m 44s
DryRun Security
Details
General Security Analyzer Findings: 1 detected
⚠️ Account Takeover via Social Auth Mapping Misconfiguration dojo/settings/settings.dist.py (click for details)
| Type | Account Takeover via Social Auth Mapping Misconfiguration |
| Description | The DD_SOCIAL_AUTH_CREATE_USER_MAPPING setting allows an administrator to define which attribute from a social provider (e.g., 'username', 'email', 'fullname') should be used as the local username during user creation or linking. If this setting is configured to use a non-unique or unverified attribute like 'fullname', an attacker can create a social account with a 'fullname' matching a victim's existing local username. When the attacker attempts to log in via social authentication, the system will use the attacker's social 'fullname' as the username, potentially linking their social account to the victim's local account and leading to an account takeover. |
| Filename | dojo/settings/settings.dist.py |
| CodeLink | django-DefectDojo/dojo/settings/settings.dist.py Lines 113 to 119 in 88361c9 |
Loading