Auth0 does not validate email addresses for non-social logins; VCell never checks the email_verified claim

Open
  • Is something wrong?
#2,035 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
java
Domain
authentication, security

Research direction

Start at vcell-rest/src/main/java/org/vcell/restq/handlers/UsersResource.java around lines 197-203, where the JWT email claim is read and passed to UserRestService.createUserIdentity. Trace how the email flows into UserRestService.java:188 and how requestRecoveryEmail (UsersResource.java:98-148) consumes userInfo.email, then add an email_verified check before registration writes the address. Done looks like: registration rejects or restricts unverified claims, existing behavior is covered by the project's REST tests, and the Auth0 tenant configuration gap (item 1) is documented as an ops task outside the repo.

Written by the indexing model from the issue text.

Description

Java-based Security

Summary

For non-social logins (the Auth0 Username-Password-Authentication database connection), email addresses are never validated. A user can register with an email address they do not control, and VCell will accept it and store it as the account's contact address.

Social logins (Google, etc.) are not affected in the same way, because the upstream identity provider has already verified the address before issuing the claim.

Two separate gaps

1. Auth0 tenant configuration — the database connection does not require email verification, so no verification email is sent and an unverified account is fully usable.

2. VCell does not check the email_verified claim — even if Auth0 did mark the address unverified, VCell would not notice. email_verified does not appear anywhere in this repository:

$ grep -rn "email_verified\|emailVerified" --include="*.java" --include="*.ts" --include="*.properties" .
(no matches)

The email claim is taken from the JWT and written straight into the new user's record, with no verification check:

  • vcell-rest/src/main/java/org/vcell/restq/handlers/UsersResource.java:197 — String email = jwt.getClaim("email");
  • vcell-rest/src/main/java/org/vcell/restq/handlers/UsersResource.java:203 — userRestService.createUserIdentity(subject, issuer, email, name, userRegistrationInfo);
  • vcell-rest/src/main/java/org/vcell/restq/services/UserRestService.java:188 — newUserInfo.email = email;

Why it matters

The stored email is not cosmetic — it is used as an account-recovery channel. requestRecoveryEmail (UsersResource.java:98-148) matches a supplied address against userInfo.email and, on a match, mails a magic link that links an Auth0 identity to a legacy VCell account. An unverified address in that field weakens the recovery path, and it also means support/notification mail can be directed at an address the account holder never proved they own.

Suggested fix

  • Turn on email verification for the Auth0 database connection (tenant config).
  • Reject or restrict registration in UsersResource when the JWT's email_verified claim is absent or false, rather than trusting email unconditionally.
  • Decide what to do about existing accounts created with unverified addresses.

Notes

Gap 2 is confirmed by inspection of this repository. Gap 1 is as reported and should be confirmed against the live Auth0 tenant settings.

Dominant language
Java
Stars
140
Forks
35
Avg merge
17h 39m
Merged PRs (30d)
19

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from virtualcell/vcell

All issues in virtualcell/vcell

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.