Summary
Tugtainer's OIDC authentication flow can be started even when the application's OIDC feature switch is disabled. A direct request to the OIDC login endpoint may create an authentication state and redirect the user to the configured identity provider, bypassing the intended configuration control.
Affected context
The issue affects Tugtainer deployments that use the OIDC authentication integration and have OIDC disabled through configuration. Although the feature-status endpoint reports that OIDC is unavailable, the login endpoint may still process requests and begin the external identity-provider flow.
Exploit preconditions
- Attack surface: The application's OIDC login HTTP endpoint
- Required access: Network access to the Tugtainer web application; successful authentication may depend on the configured identity provider and deployment controls
- Trigger point: A direct request to the OIDC login route while OIDC is configured as disabled
- Why exploitation is possible: The login handler does not consistently enforce the OIDC feature flag before creating state and issuing a redirect
Why this happens
The vulnerability results from inconsistent enforcement of an authentication feature flag across related endpoints. The status endpoint honors the disabled state, while the login handler continues to initiate OIDC processing. This represents CWE-284: Improper Access Control, because a security-relevant configuration restriction is not enforced at the protected operation itself.
Potential impact
- An attacker may initiate an authentication flow that administrators intended to disable
- Users could be redirected to an unexpected or unauthorized identity-provider endpoint
- Authentication policy enforcement may be weakened
- The application could expose state-management behavior for a disabled authentication mechanism
- Depending on surrounding configuration, unauthorized access could become possible
General mitigation guidance
Mitigation generally focuses on enforcing authentication configuration consistently at every relevant route.
Common defensive patterns include:
- Rejecting OIDC login requests whenever the OIDC feature is disabled
- Applying feature-flag checks within the login handler rather than relying only on status endpoints
- Ensuring disabled authentication providers cannot create session state, cookies, or redirects
- Using explicit allowlists for enabled authentication mechanisms and redirect destinations
- Applying least privilege to application identities and limiting administrative authentication paths
- Testing disabled-feature behavior as part of integration and authorization test suites
How teams detect issues like this
Organizations can look for this class of issue through:
- Integration tests that verify disabled authentication providers reject login requests
- Static analysis and code review checks for inconsistent feature-flag enforcement across related routes
- Monitoring for requests to disabled authentication endpoints and unexpected HTTP 302 responses
- Detection of state cookies or external authorization redirects generated while OIDC is disabled
- Policy checks requiring authentication handlers to validate provider configuration before side effects
Automated security review tools may help identify route-level authorization and configuration-check inconsistencies.
