aap-gateway vulnerabilities

In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.

A flaw was found in the AAP gateway where the user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.

A Cross-site Scripting (XSS) vulnerability exists in the aap-gateway component. A malicious user can exploit the "?next=" parameter in a URL to perform redirects, inject malicious scripts, and steal sessions and data.