{"id":"CVE-2026-121939","kind":"vulnerability","aliases":["CVE-2026-121939"],"related":[],"title":"Databasement: OAuth login links accounts by unverified email, allowing takeover","description":"Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.","summary":"Databasement links OIDC logins to existing local accounts by email without checking that the email is verified. An attacker can sign in through an identity provider account using a victim's unverified email and gain access to that user, including the super-admin, and keep it after password resets.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databasement","oidc","package","self-hosted","sso"],"not_affected_if":["oidc-disabled","version-1.10.9-or-later"],"how_to_check":"- Check the Databasement version in use; versions below `1.10.9` are affected.\n- Check whether OIDC/OAuth login is enabled in the Databasement configuration.","fix":"- Databasement: upgrade to `1.10.9` or later.","status":"open","published_at":"2026-11-04T13:17:28+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","triaged_at":"2026-11-04T13:27:51+00:00","updated_at":"2026-11-04T13:27:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T13:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- Databasement: upgrade to `1.10.9` or later.","reach":"internet","title":"Databasement: OAuth login links accounts by unverified email, allowing takeover","impact":"high","summary":"Databasement links OIDC logins to existing local accounts by email without checking that the email is verified. An attacker can sign in through an identity provider account using a victim's unverified email and gain access to that user, including the super-admin, and keep it after password resets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["databasement","self-hosted","oidc","sso"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over any account, including super-admin, persistently","analyst_note":"Confirm the affected version range and whether the vendor advisory on GitHub lists any configuration requirements beyond OIDC login.","how_to_check":"- Check the Databasement version in use; versions below `1.10.9` are affected.\n- Check whether OIDC/OAuth login is enabled in the Databasement configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.10.9-or-later","oidc-disabled"],"who_is_affected":"Teams that run Databasement with OIDC or OAuth single sign-on enabled, in a version before 1.10.9. The flaw lies in how logins are matched to local accounts, so instances without OIDC login are unlikely to be exposed. Whether an identity provider allows unverified emails also matters for exploitation; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000705,"input_tokens":4210,"output_tokens":569,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-121939':13A,16A '-2026':12A,15A '1.10.9':76C 'access':59B,124C 'account':5A,31B,50B,104C 'admin':67B,121C 'allow':9A 'attack':42B,98C 'authent':79C 'bypass':80C 'check':35B,95C 'contain':77C 'cve':11A,14A 'databas':1A,17B,24B,74C 'email':8A,33B,38B,56B,93C,96C,110C 'exist':29B 'findorcreatelocalus':84C 'gain':58B 'host':22B 'ident':48B,88C,102C 'includ':63B,117C 'keep':69B 'link':4A,25B,86C 'local':30B,90C 'log':112C 'login':3A,27B 'oauth':2A 'oauthservic':83C 'oidc':18B,26B,87C 'packag':19B 'password':72B,126C 'provid':49B,103C 'regist':100C 'reset':73B,127C 'retain':123C 'self':21B 'self-host':20B 'sign':44B 'sso':23B 'super':66B,120C 'super-admin':65B,119C 'takeov':10A 'unverifi':7A,55B,109C 'use':51B 'user':62B,91C,116C 'verifi':40B,97C 'victim':53B,107C 'vulner':81C 'without':34B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Databasement with OIDC or OAuth single sign-on enabled, in a version before 1.10.9. The flaw lies in how logins are matched to local accounts, so instances without OIDC login are unlikely to be exposed. Whether an identity provider allows unverified emails also matters for exploitation; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","databasement","oidc","package","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-03T23:19:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121939","severity":null,"published_at":"2026-11-04T13:17:28+00:00","modified_at":"2026-11-04T13:17:28+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","fetched_at":"2026-11-04T13:27:03+00:00","note":null}],"documents":[{"id":67078,"url":"https://github.com/David-Crty/databasement/commit/b7f4079c02b7ce3f1cf2844de182e809636c3382","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67079,"url":"https://github.com/David-Crty/databasement/releases/tag/v1.10.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":67080,"url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-mh6w-2cch-w8v8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T23:19:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":67081,"url":"https://www.vulncheck.com/advisories/databasement-before-1.10.9-account-takeover-via-oidc-email-auto-linking","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}