Email sign-in code could be brute-forced

Summary

Firezone's email-based sign-in ("magic link" / email one-time passcode) issues a short one-time code that the user submits to complete sign-in. The code had insufficient entropy, and the verification endpoint enforced no per-code or per-account limit on the number of incorrect guesses — a live code was invalidated only when the correct value was submitted or when it expired after 15 minutes. The only throttle in front of the verification endpoint was a per-source-IP rate limit. The same weak code and unbounded verification were also used in the OIDC "proof of email ownership" pending-identity flow.

As a result, a remote, unauthenticated attacker who initiated an email sign-in for a victim's address could attempt to guess the live code by distributing requests across many source IPs to evade the per-IP rate limit, recovering the code within its 15-minute validity window.

Impact

By recovering a live one-time code within its validity window, an attacker who knows a target's email address — on an account that has email sign-in enabled for that user — could complete sign-in as the victim, taking over the account. For a standard user this confers the victim's authorized access to Resources through Firezone's data plane; for an administrator it confers administrative control of the tenant, including Policies, Resources, Gateways, actors, and identity-provider configuration.

Exploitation was costly and complex in practice. Because the per-IP rate limit constrains guessing from any single source, an attacker would have had to spread guesses across many thousands of distinct machines — on the order of tens of thousands of source IP addresses — to have a meaningful chance of recovering a code within its 15-minute lifetime. The same conditions applied to the OIDC pending-identity verification endpoint.

We have found no evidence that this vulnerability was exploited, or that exploitation was attempted.

Who is affected

This issue affects the Firezone-managed service. For a given user to have been exposed on the email sign-in path, all of the following had to be true:

• The account had email/OTP authentication enabled as a sign-in method.
• The targeted actor was not disabled (suspended or deleted actors cannot sign in).
• The targeted actor had the "allow email/OTP sign-in" flag enabled, which permits that actor to authenticate via email/OTP.

The same weak code was also used by the OIDC pending-identity ("proof of email ownership") verification flow. Because the portal is operated by Firezone as part of the managed service, this issue was addressed centrally and no customer action is required.

Remediation

This issue has been remediated in the Firezone-managed service; no action is required. The fix substantially increases the entropy of the one-time code and enforces a strict limit on the number of verification attempts per code, on both the email sign-in and the OIDC pending-identity paths.

Workarounds

None required — the issue is resolved in the managed service.

Credits

Reported by 5ud0 / Tarmo Technologies.