---
id: "CVE-2026-111639"
kind: "vulnerability"
aliases: ["CVE-2026-111639"]
title: "bbs-go: Google One Tap login accepts tokens from any client, enabling account takeover"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bbs-go", "google-oauth", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-16T18:17:44+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:00:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111639", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# bbs-go: Google One Tap login accepts tokens from any client, enabling account takeover

bbs-go through 4.4.6 has an authentication bypass in its /api/login/google_one_tap endpoint. Because the endpoint never checks the aud claim of submitted Google ID tokens, an attacker can replay a token issued to their own OAuth client and get a session as the victim's Google-linked account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look up the installed bbs-go version and compare it with `4.4.6`
- Check whether the Google One Tap login route `/api/login/google_one_tap` is reachable on your deployment
- unknown whether other check methods are needed

## Fix

- Upgrade bbs-go to a release later than `4.4.6`
- If no fixed release is available, disable Google One Tap login until it is patched
- unknown whether a specific fixed version exists

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111639

## From the sources

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_