6 matches found
CVE-2026-121939
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...
CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...
CVE-2026-121939
The software Databasement versions prior to 1.10.9 is affected by an authentication bypass vulnerability in the OAuthService::findOrCreateLocalUser() function. The root cause is that the system links OIDC identities to local users based on email addresses without verifying the email_verified stat...
EUVD-2026-116896
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...
PT-2026-136959
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking email verified. Attackers can register an identity provider account with a victim's unverified email to log in as a...
CVE-2026-121939: David-Crty Databasement: Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser()…
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...