CVE-2025-49006 Overview
Wasp (Web Application Specification) is a Rails-like framework for React, Node.js, and Prisma. Versions prior to 0.16.6 contain an authentication flaw in the OAuth implementation that affects deployments using Keycloak with case-sensitive user identifiers. Wasp lowercases OAuth user IDs before storing and retrieving them from its database. This behavior violates the OAuth and OpenID Connect specifications, which treat subject identifiers as case-sensitive strings. The flaw can lead to user impersonation, account collisions, and privilege escalation when two distinct Keycloak users share identifiers that differ only in letter casing.
Critical Impact
Attackers controlling a Keycloak account with a case-variant identifier can collide with an existing Wasp account and assume its identity.
Affected Products
- Wasp framework versions prior to 0.16.6
- Wasp applications configured with Keycloak OAuth using case-sensitive user IDs
- Deployments relying on Wasp's built-in OAuth authentication module
Discovery Timeline
- 2025-06-09 - CVE-2025-49006 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-49006
Vulnerability Analysis
The vulnerability is classified under [CWE-276] Incorrect Default Permissions, but functionally represents a broken access control flaw in OAuth identity resolution. Wasp's authentication layer normalizes OAuth subject identifiers to lowercase before persisting them or looking them up during login. OAuth 2.0 and OpenID Connect specifications require the sub claim to be treated as a case-sensitive opaque string. When Wasp folds case, two distinct upstream identities can map to the same local account record.
Among supported providers, only Keycloak is affected in practice. Keycloak uses lowercase UUIDs by default, which prevents collisions in default configurations. However, administrators can configure Keycloak realms to issue case-sensitive identifiers. Google, GitHub, and Discord issue numerical IDs that contain no alphabetic characters, so case folding has no effect on them.
Root Cause
The root cause is improper input normalization on a security-sensitive identifier. The Wasp authentication code applied toLowerCase() semantics to the provider-supplied user ID before persisting or comparing it. This transformation broke the bijection between upstream identities and local accounts, allowing distinct OAuth subjects to map to one Wasp user record.
Attack Vector
An attacker with the ability to create or control a Keycloak account can choose an identifier that differs from a target victim's identifier only in letter casing. When the attacker authenticates to a Wasp application, the lowercased identifier matches the victim's stored record. Wasp then authenticates the attacker as the victim, granting full access to the victim's session, data, and privileges. The attack requires network access to the Wasp application and a Keycloak realm configured with case-sensitive identifiers.
No verified public exploit code is available. See the Wasp Notion Vulnerability Report and the GitHub Security Advisory for technical details.
Detection Methods for CVE-2025-49006
Indicators of Compromise
- Multiple Keycloak users authenticating into the same Wasp account record
- Authentication audit logs showing OAuth sub claims that differ only in letter casing yet resolve to the same internal user ID
- Unexpected privilege changes or session activity on accounts using Keycloak SSO
Detection Strategies
- Audit the Wasp Auth and AuthIdentity tables for duplicate or near-duplicate providerUserId values that share lowercase forms
- Correlate Keycloak issued sub claims with Wasp authentication records to identify case-collision conditions
- Review application logs for the 0.16.5 or earlier Wasp version string combined with Keycloak provider entries
Monitoring Recommendations
- Enable verbose OAuth login logging on the Wasp application and forward events to a centralized log store
- Alert on first-time logins to long-standing accounts that arrive from Keycloak with previously unseen sub claim casing
- Track Keycloak realm configuration changes that introduce case-sensitive user identifier formats
How to Mitigate CVE-2025-49006
Immediate Actions Required
- Upgrade all Wasp applications to version 0.16.6 or later, which removes the lowercase normalization
- Inventory Keycloak realm configurations and identify any using case-sensitive user identifiers
- Force re-authentication and review recent login events for affected Keycloak-backed accounts
Patch Information
The fix is delivered in Wasp 0.16.6. The corrective change is published in the GitHub Commit Update and described in the GitHub Security Advisory. The patch preserves the original casing of OAuth user identifiers when storing and comparing records.
Workarounds
- Reconfigure affected Keycloak realms to issue case-insensitive user identifiers, such as the default lowercase UUID format
- Restrict Keycloak user provisioning to a controlled set of administrators to prevent attacker-chosen identifiers
- Disable the Keycloak OAuth provider in Wasp until the upgrade to 0.16.6 is complete
# Upgrade Wasp to the patched version
npm install -g wasp-lang@0.16.6
wasp --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
