OIDC authentication fails when the email starts with digits (e.g. [email protected])

Environment Kutt version: 3.2.6 Database: PostgreSQL 14 Authentication: OIDC (Microsoft Entra ID) Deployment: OpenShift Official Docker image Description

We identified an issue during OIDC authentication when the authenticated user's email address starts with digits.

Example:

[email protected]

The OIDC authentication succeeds, but immediately after login Kutt returns:

OIDC authentication failed

The PostgreSQL log shows:

ERROR: invalid input syntax for type integer: "[email protected]" Root Cause

The issue is caused by the use of parseInt() to determine whether the user filter represents a numeric user id or an email address.

Current implementation:

if (params?.user) { const id = parseInt(params.user);

if (Number.isNaN(id)) { query[knex.compatibleILIKE]( "users.email", "%" + params.user + "%" ); } else { query.andWhere("links.user_id", params.user); } }

The problem is that:

parseInt("[email protected]")

returns:

12345

instead of NaN.

As a consequence, Kutt assumes the value is a numeric user id, but still sends the original email string to PostgreSQL:

WHERE links.user_id = '[email protected]'

Since links.user_id is an integer column, PostgreSQL raises:

ERROR: invalid input syntax for type integer PostgreSQL log ERROR: invalid input syntax for type integer: "[email protected]"

STATEMENT: select ... from "links" left join "domains" ... left join "users" ... where "links"."user_id" = $1

The same issue also occurs in the count query:

select count(*) from links ... where links.user_id = $1 Files affected

The same logic exists in:

server/queries/link.queries.js

totalAdmin() getAdmin()

and possibly similar code in:

server/queries/domain.queries.js Suggested fix

Instead of relying on parseInt(), validate whether the entire string is numeric.

For example:

const isNumericId = /^\d+$/.test(params.user);

if (isNumericId) { query.andWhere("links.user_id", Number(params.user)); } else { query[knex.compatibleILIKE]( "users.email", %${params.user}% ); }

or any equivalent validation that only accepts values composed entirely of digits.

How to reproduce Configure OIDC authentication. Authenticate using an account whose email starts with digits.

Example:

[email protected] Login succeeds at the Identity Provider. The user is redirected back to Kutt. Kutt displays: OIDC authentication failed PostgreSQL logs contain: ERROR: invalid input syntax for type integer Expected behavior

Kutt should recognize:

[email protected]

as an email address rather than interpreting it as a numeric user identifier.

Additional notes

During the investigation, we verified that:

OIDC authentication completes successfully in Microsoft Entra ID. The callback reaches Kutt correctly. PostgreSQL, Redis, and OpenShift are operating normally. The failure occurs only when the application attempts to retrieve the authenticated user's links. The root cause is the use of parseInt() to distinguish between user IDs and email addresses. Since parseInt() stops parsing at the @ character, any email starting with digits is incorrectly treated as a numeric identifier.

Replacing this validation with a strict numeric check (for example, /^\d+$/) prevents the issue and correctly handles email addresses that begin with digits.