BUDGET BOARD · CVE-2026-68551 · Other
NO FIX YET · SEE WHAT TO DO
Budget Board's OIDC login matches existing local accounts by the email address in the identity provider's token without checking email_verified. If the configured identity provider lets someone register or display an email they do not own, an attacker can sign into the victim's Budget Board account, including linked bank data.
first public Jul 5, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure requires Budget Board before 3.6.2 with OIDC login enabled, and an identity provider that lets users claim an email address without verifying it. Instances that use only local accounts, or an identity provider that enforces verified emails, are not exposed to this path.
Not affected if local-auth-only, verified-email-idp, version-3.6.2-or-later
Who cares budget-board, oidc, self-hosted
3.6.2 is affected.3.6.2 or later.Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.