{"id":"CVE-2026-111639","kind":"vulnerability","aliases":["CVE-2026-111639"],"related":[],"title":"bbs-go: Google One Tap login accepts tokens from any client, enabling account takeover","description":"bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.","summary":"bbs-go through 4.4.6 has an authentication bypass in its /api/login/google_one_tap endpoint. Because the endpoint never checks the aud claim of submitted Google ID tokens, an attacker can replay a token issued to their own OAuth client and get a session as the victim's Google-linked account.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bbs-go","google-oauth","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Look up the installed bbs-go version and compare it with `4.4.6`\n- Check whether the Google One Tap login route `/api/login/google_one_tap` is reachable on your deployment\n- unknown whether other check methods are needed","fix":"- Upgrade bbs-go to a release later than `4.4.6`\n- If no fixed release is available, disable Google One Tap login until it is patched\n- unknown whether a specific fixed version exists","status":"open","published_at":"2026-10-16T18:17:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:00:05+00:00","updated_at":"2026-10-25T03:00:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bbs-go to a release later than `4.4.6`\n- If no fixed release is available, disable Google One Tap login until it is patched\n- unknown whether a specific fixed version exists","reach":"internet","title":"bbs-go: Google One Tap login accepts tokens from any client, enabling account takeover","impact":"high","summary":"bbs-go through 4.4.6 has an authentication bypass in its /api/login/google_one_tap endpoint. Because the endpoint never checks the aud claim of submitted Google ID tokens, an attacker can replay a token issued to their own OAuth client and get a session as the victim's Google-linked account.","category":"package","nicknames":[],"who_cares":["bbs-go","self-hosted","google-oauth"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker logs in as any Google-linked user, taking over their account","analyst_note":"Confirm the fixed version and whether Google One Tap is enabled by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111639 and the bbs-go project repository.","how_to_check":"- Look up the installed bbs-go version and compare it with `4.4.6`\n- Check whether the Google One Tap login route `/api/login/google_one_tap` is reachable on your deployment\n- unknown whether other check methods are needed","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Deployments of bbs-go up to and including 4.4.6 that expose the Google One Tap login endpoint are exposed. Anyone who does not run bbs-go, or runs a version newer than 4.4.6 with the fix applied, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":3372,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111639':18A,21A '-2026':17A,20A '/api/login/google_one_tap':43B,94C '4.4.6':36B,86C 'accept':8A 'account':14A,81B,155C 'allow':97C 'attack':59B,99C,116C 'aud':51B,138C 'authent':39B,89C,146C 'bbs':2A,23B,33B,83C 'bbs-go':1A,22B,32B,82C 'bypass':40B,90C 'captur':124C 'check':49B,142C 'claim':52B,139C 'client':12A,69B,115C,122C 'contain':87C 'cve':16A,19A 'enabl':13A 'endpoint':44B,47B,95C 'get':71B 'go':3A,24B,34B,84C 'googl':4A,26B,55B,79B,108C,120C,129C,153C 'google-link':78B,152C 'google-oauth':25B 'google-sign':128C 'host':31B 'id':56B,109C,131C 'issu':64B,111C 'link':80B,154C 'log':101C 'login':7A 'never':48B,141C 'oauth':27B,68B,114C,121C 'obtain':144C 'one':5A 'oper':117C 'packag':28B 'remot':98C 'replay':61B,134C 'self':30B 'self-host':29B 'session':73B,147C 'sign':130C 'sinc':136C 'submit':54B,107C 'takeov':15A 'tap':6A 'token':9A,57B,63B,110C,132C 'user':105C 'victim':76B,126C,150C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Deployments of bbs-go up to and including 4.4.6 that expose the Google One Tap login endpoint are exposed. Anyone who does not run bbs-go, or runs a version newer than 4.4.6 with the fix applied, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111639","severity":null,"published_at":"2026-10-16T18:17:44+00:00","modified_at":"2026-10-21T21:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}