CVE-2026-86117

Coolify (through version 4.3.17 ) is affected by an authentication bypass in its OAuth callback handler. The root cause is that the handler signs users into existing accounts based solely on email address matching , without verifying provider assertions or binding OAuth identities. An attacker ca...

EUVD-2026-71949

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757 — AshAuthentication OAuth2/OIDC アカウント乗っ取り CVE-2026-49757 の概念実証 — AshAuthentication における重大な脆弱性で、OAuth2/OIDC コールバックが strategy, sub の識別子ペアではなく メールアドレス でローカルユーザーアカウントを解決するため、認証されていないアカウント乗っ取りが可能になります。 フィールド| 値 ---|--- CVE| CVE-2026-49757 CVSS 4.0| 9.2 Critical CWE| CWE-290 Authenticati...

ANT-2026-7WJV60DR · supabase/auth · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7WJV60DR: Manual identity linking enables account takeover via unverified email When...

CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

SUSE CVE-2026-55075

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link...

CVE-2026-55075

Coder’s OIDC login flaw leads to account takeover via email-based user matching and improper handling of email_verified. Before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two issues exist: (1) email-based matching could link by email without confirming an existing link to a different IdP subjec...

CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link...

CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link...

Authentication Bypass by Alternate Name

Overview Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via improper handling of OIDC authentication and the emailverified claim. An attacker can gain unauthorized access to another user's account by authenticating with an email address matching the...

GHSA-9R87-MVCW-X35F Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the emailverified claim was only enforced when present as a boolean false so an absent or non-boolean...

EEF-CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Summary Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined...

CVE-2026-49757

AshAuthentication (versions before 4.14.0 and before 5.0.0-rc.10) is vulnerable to an authentication bypass where OAuth2/OIDC sign-in matches local users by email rather than the issuer/sub identity. An attacker able to provide a victim’s email to an OAuth provider could be signed in to the victi...

Nhost 授权问题漏洞

Nhost is an open-source backend service platform developed by Nhost. Versions of Nhost prior to 0.49.1 contained an authorization vulnerability. This vulnerability stemmed from the automatic matching of email addresses during OAuth authentication. However, some provider adapters failed to properl...

CVE-2026-6266

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...

EUVD-2026-26967

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...

CVE-2026-6266 Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider IDP identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a...

CVE-2026-34456

The CVE concerns Reviactyl, an open-source game server management panel (Laravel/React stack). From version 26.2.0-beta.1 to before 26.2.0-beta.5, the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses, enabling an attacker to create or...

Directus has MySQL accent insensitive email matching

Password reset vulnerable to accent confusion The password reset mechanism of the Directus backend is implemented in a way where combined with specific, need to double check if i can work around configuration in MySQL or MariaDB. As such, it allows attackers to receive a password reset email of a...

GHSA-QW9G-7549-7WG5 Directus has MySQL accent insensitive email matching

Password reset vulnerable to accent confusion The password reset mechanism of the Directus backend is implemented in a way where combined with specific, need to double check if i can work around configuration in MySQL or MariaDB. As such, it allows attackers to receive a password reset email of a...