Domain-wide signup session enables cross-tenant administrator takeover

Summary

A parent-domain signup JWT carried a global user ID but no tenant identity

An unauthenticated attacker could complete public signup for their own Fider tenant, then present the temporary parent-domain cookie to an existing victim subdomain and be authenticated there with the attacker's Administrator role.

Root cause. The JWT contained a global user ID but no tenant claim. Middleware loaded that ID through an unscoped query, and dbEntities.User.ToModel replaced the persisted tenant with the request tenant, making the final tenant equality check tautological while preserving the source role and security stamp.

Remediation evidence. Fider responded to the disclosure and merged exact PR #1623 on 27 July 2026. The fix binds the persisted user to its real tenant, scopes lookup by tenant, and prevents the transfer cookie from being promoted on a foreign host.

CVSS Score

VectorN

ComplexityL

PrivilegesN

User InteractionN

ScopeC

ConfidentialityH

IntegrityH

AvailabilityH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vulnerability Location

SourceLine 84

app/handlers/signup.go

CreateTenant()

SinkLine 126

app/middlewares/user.go

User()

Source-to-Sink Analysis

app/handlers/signup.go:84

Public signup creates an attacker-controlled tenant and Administrator, then sets a temporary authentication cookie for the shared parent domain.

SetSignUpAuthCookie(c, createTenant.Result, user) // Domain=.HOST_DOMAIN

app/middlewares/user.go:126

On a victim subdomain, middleware decoded the global user ID and loaded it without a tenant predicate.

claims := jwt.DecodeFiderClaims(token)
q := &query.GetUserByID{UserID: claims.UserID}
bus.Dispatch(c, q)

app/pkg/dbx/entities/user.go:ToModel()

Mapping substituted the victim request tenant into the attacker user object, allowing the equality guard to pass with the Administrator role intact.

user.Tenant = contextTenant
if user.Tenant.ID == c.Tenant().ID { c.SetUser(user) }

Impact Analysis

Critical Impact

The attacker obtains administrator access to another tenant, including its backup/export data, users, feedback, settings, integrations, and broad mutation endpoints. This is a complete cross-tenant confidentiality, integrity, and availability compromise short of separately owner-guarded whole-site deletion.

Attack Surface

Public OAuth signup on multi-host Fider deployments using a shared parent HOST_DOMAIN.

Preconditions

Public signup and a built-in OAuth provider are enabled. The attacker needs only their own provider account and the victim tenant's public subdomain; no victim interaction or secret is required.

Proof of Concept

Environment Setup

Run a vulnerable multi-host Fider deployment with public signup, an attacker tenant, and a seeded victim tenant.

Target Configuration

Configure one shared HOST_DOMAIN and a public OAuth provider. Use only attacker-owned provider credentials.

Exploit Delivery

Create the attacker tenant, preserve its __signup_auth cookie, then request an administrator-only victim-host route such as the backup export before visiting the attacker tenant.

Outcome

PR #1623 rejects the tenant mismatch using signed/persisted identity and tenant-scoped lookup before installing a user context.

Expected Response: The vulnerable server returns victim-tenant administrator content and promotes a host cookie even though the JWT user belongs to the attacker tenant.

Run this level of analysis on your repo.

Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.

Vulnerability Detection

View Patch PRVerify fix on GitHub