VulnSocial

CVE-2026-121939

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-04: 111-04
Referenced assets1 URL
Full discourse1 post
  • cve.now@cvedotnow

    🆕 New CVE David-Crty Databasement: account takeover via OIDC email auto-linking (CVE-2026-121939) A remote attacker can take over any local account, including super-admins, and keep access after password resets. Patch → 1.10.9 https://cve.now/CVE-2026-121939?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical

    030531.4K
    21.7K followersView on X

Explore more

Back to dashboard