---
id: "CVE-2026-121939"
kind: "vulnerability"
aliases: ["CVE-2026-121939"]
title: "Databasement: OAuth login links accounts by unverified email, allowing takeover"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["databasement", "oidc", "package", "self-hosted", "sso"]
not_affected_if: ["oidc-disabled", "version-1.10.9-or-later"]
published_at: "2026-11-04T13:17:28+00:00"
first_seen_at: "2026-11-04T13:27:03+00:00"
updated_at: "2026-11-04T13:27:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121939", "first_seen_at": "2026-11-04T13:27:03+00:00"}]
---

# Databasement: OAuth login links accounts by unverified email, allowing takeover

Databasement links OIDC logins to existing local accounts by email without checking that the email is verified. An attacker can sign in through an identity provider account using a victim's unverified email and gain access to that user, including the super-admin, and keep it after password resets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Databasement version in use; versions below `1.10.9` are affected.
- Check whether OIDC/OAuth login is enabled in the Databasement configuration.

## Fix

- Databasement: upgrade to `1.10.9` or later.

## Timeline

- 2026-11-04T13:27:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121939

## Documents

- [advisory] Vendor advisory: github.com https://github.com/David-Crty/databasement/security/advisories/GHSA-mh6w-2cch-w8v8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/databasement-before-1.10.9-account-takeover-via-oidc-email-auto-linking
- [fix] Patch: github.com https://github.com/David-Crty/databasement/commit/b7f4079c02b7ce3f1cf2844de182e809636c3382
- [fix] Release notes: github.com https://github.com/David-Crty/databasement/releases/tag/v1.10.9

## From the sources

Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_