CVE-2026-51584

CVE-2026-51584 affects usememos v0.27.1. The vulnerability resides in the SignIn handler (server/router/api/v1/auth_service.go), specifically the ssoCredentials branch, where SSO identity is matched only on an attacker-controllable identifier and is not bound to the IdP’s stable subject claim. Th...