# Bypass Email Verification using Salesforce -- Reproducible in gitlab.com

GitLab's Salesforce OAuth login trusted the Salesforce-supplied email without verification, letting an attacker sign up with any email domain.

- Payout: hidden
- Severity: high
- Program: GitLab
- Found by: ngalog
- Disclosed: 2019-12-13
- CVE: CVE-2019-5486
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/617896
- Library page: https://bugbountylibrary.com/r/h1%3A617896
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Salesforce OAuth login integration on gitlab.com
**Root cause:** GitLab's Salesforce OAuth integration trusted the email address returned by Salesforce without verifying ownership; Salesforce admins can set arbitrary emails on users, so the identity provider's email is not proof of ownership.
**Steps:**
1. Create a Salesforce user with an arbitrary email (e.g. a restricted domain) via Salesforce admin.
2. Visit the Okta preview login and authenticate to Salesforce with the attacker-controlled account.
3. In a new tab open `https://gitlab.com/users/sign_in` and click login with Salesforce.
4. The GitLab account is created/logged in with the arbitrary email; confirm at `https://gitlab.com/profile/emails`.
**How found:** Researcher reasoned that Salesforce lets admins assign arbitrary emails to users, so any OAuth integration trusting Salesforce's email claim inherits that weakness; tested by creating such a user and logging into gitlab.com.
**Exploitation:** Attacker with a Salesforce account whose email is set to an arbitrary/restricted domain logs into GitLab via Salesforce OAuth; GitLab provisions the account with that unverified email, bypassing domain whitelist/blacklist restrictions.
**Insight:** For OAuth/OIDC integrations, treat the IdP email claim as unverified unless the IdP enforces email ownership; check whether the IdP allows admins to set arbitrary emails (Salesforce, some Okta configs) and test login with a restricted-domain email.