CVE-2026-111639

The bbs-go application (through version 4.4.6 ) contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. The root cause is a failure to verify the aud claim in Google-signed ID tokens, allowing remote attackers to replay tokens issued to any OAuth client. By usin...