CVE-2026-121939 · Package
NO FIX YET · SEE WHAT TO DO
Databasement links OIDC logins to existing local accounts by email without checking that the email is verified. An attacker can sign in through an identity provider account using a victim's unverified email and gain access to that user, including the super-admin, and keep it after password resets.
first public Nov 3, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run Databasement with OIDC or OAuth single sign-on enabled, in a version before 1.10.9. The flaw lies in how logins are matched to local accounts, so instances without OIDC login are unlikely to be exposed. Whether an identity provider allows unverified emails also matters for exploitation; the sources do not say more.
Not affected if oidc-disabled, version-1.10.9-or-later
Who cares databasement, oidc, self-hosted, sso
1.10.9 are affected.1.10.9 or later.Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
This page as .md · .json · in your agent: get_signal("CVE-2026-121939") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.