CVE-2026-126801

Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint. This flaw allows authenticated users to merge any OAuth-bound account into their own by submitting a public existingUserId and a GitHub or Apple user ID . Successful exploitation results ...