CVE-2026-51584

CVE-2026-51584 affects usememos v0.27.1. The vulnerability resides in the SignIn handler (server/router/api/v1/auth_service.go), specifically the ssoCredentials branch, where SSO identity is matched only on an attacker-controllable identifier and is not bound to the IdP’s stable subject claim. Th...

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

EUVD-2026-56175

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...