Cumora patches Apple sign-in flaw that let emails hijack accounts

Cumora patched a bug in its Apple sign-in flow that let a client-supplied email address link a new Apple identity to someone else's existing account. Anyone who could set that field in the request could point their Apple sign-in at somebody else's account without any server-side check.

The native endpoint took the email straight from the request body and fell back to it whenever Apple's signed token carried none. That fallback value was enough to bind the new Apple identity to an account under a different login.

Cumora's v0.2.2 release removes the email field from the request contract entirely. There's no more client-supplied value to fall back to. For an Apple sub that isn't already linked, the app now requires an email_verified claim inside Apple's own token. Without that claim, it won't trust the address.

The release notes don't say how long the field sat in the request contract, or whether Cumora found it through review or a report. They don't say whether any accounts were linked this way before the patch.