David-Crty

CVE-2026-121939: Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by

CVE-2026-121939 Nov 4, 2026 Source: Vendor

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-121939

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-121939 BR2026-0000-042255 unclaimed

Credited as chinosk