PST-064: No notification is sent when a password, address or second factor changes #793

New issue

Closed

opened 2026-10-10 10:56:35 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-10 10:56:35 +00:00

Owner

Found in the security audit of 2026-10-10 (SECURITY-AUDIT-2026-10-10.md), run against main at c30851b from 8 to 10 October 2026, as PST-064. Severity: Informational.

The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it.

Severity: Informational
Category: detection
Location: src/postulo/config/settings/base.py (243-262)
Found by: authentication and sessions

Who can do it, and what they need. Anyone who has already obtained a session or a credential; the gap is in detection, not in access.

How it works.

A hijacked session changes the password, adds an address or disables TOTP.
allauth's ACCOUNT_EMAIL_NOTIFICATIONS is left at its default of False, so the account holder is told nothing.
The change is noticed only when the holder next tries to sign in.

Impact. Delays discovery of the takeovers described above and of any session theft; no direct access gained.

Verification (verdict: confirmed; severity after verification: Informational). The cited range base.py:243-262 is correct only in the sense that the setting is missing there. The relevant flows are password change, password reset, password set, an added or changed address, and social account connect (those allauth calls send_notification_mail from). Remediation: set ACCOUNT_EMAIL_NOTIFICATIONS = True (or send a Postulo notification) and cover it with a test. Note that it would not warn the pre-claimed victim in PST-002 (#731).

Suggested remediation. Set ACCOUNT_EMAIL_NOTIFICATIONS = True so allauth mails the primary address on password change, address change and (via mfa signals) authenticator changes, routed through the pluggable backend.

Found in the security audit of 2026-10-10 (`SECURITY-AUDIT-2026-10-10.md`), run against `main` at `c30851b` from 8 to 10 October 2026, as **PST-064**. Severity: **Informational**. The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it. --- - **Severity:** Informational - **Category:** detection - **Location:** `src/postulo/config/settings/base.py` (243-262) - **Found by:** authentication and sessions **Who can do it, and what they need.** Anyone who has already obtained a session or a credential; the gap is in detection, not in access. **How it works.** 1. A hijacked session changes the password, adds an address or disables TOTP. 2. allauth's ACCOUNT_EMAIL_NOTIFICATIONS is left at its default of False, so the account holder is told nothing. 3. The change is noticed only when the holder next tries to sign in. **Impact.** Delays discovery of the takeovers described above and of any session theft; no direct access gained. **Verification** (verdict: confirmed; severity after verification: Informational). The cited range base.py:243-262 is correct only in the sense that the setting is missing there. The relevant flows are password change, password reset, password set, an added or changed address, and social account connect (those allauth calls send_notification_mail from). Remediation: set ACCOUNT_EMAIL_NOTIFICATIONS = True (or send a Postulo notification) and cover it with a test. Note that it would not warn the pre-claimed victim in PST-002 (#731). **Suggested remediation.** Set ACCOUNT_EMAIL_NOTIFICATIONS = True so allauth mails the primary address on password change, address change and (via mfa signals) authenticator changes, routed through the pluggable backend.

tiagoagueda added the

authentication

enhancement

security

labels

2026-10-10 10:56:35 +00:00

tiagoagueda added this to the 1.0.0 milestone

2026-10-10 10:58:02 +00:00

tiagoagueda referenced this issue

2026-10-10 10:58:40 +00:00

Security audit of 2026-10-10: index of PST-001 to PST-098 (#730–#827) #828

tiagoagueda referenced this issue from a commit