CVE-2026-121939

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as an...