Lab 419 — FlowDesk — OIDC Email Claim Account Takeover

hackadvisor

Task: FlowDesk logs in SSO users purely by the OIDC email claim (no email_verified, no sub binding). Solution: abused case-sensitive IdP self-registration vs case-insensitive login to claim the admin email in uppercase with a chosen password, then finished the SSO code flow to take over the admin.