{"id":"CVE-2026-68551","kind":"vulnerability","aliases":["CVE-2026-68551"],"related":[],"title":"Budget Board: OIDC login signs into accounts by unverified email","description":"Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.","summary":"Budget Board's OIDC login matches existing local accounts by the email address in the identity provider's token without checking email_verified. If the configured identity provider lets someone register or display an email they do not own, an attacker can sign into the victim's Budget Board account, including linked bank data.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Budget Board","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["budget-board","oidc","other","self-hosted"],"not_affected_if":["local-auth-only","verified-email-idp","version-3.6.2-or-later"],"how_to_check":"- Check the installed version: Budget Board earlier than `3.6.2` is affected.\n- Check whether OIDC login is enabled in the Budget Board configuration.\n- Check whether the OIDC provider allows users to register or set an email address without verifying it.","fix":"- Budget Board: upgrade to `3.6.2` or later.","status":"open","published_at":"2026-11-13T20:19:00+00:00","first_seen_at":"2026-11-13T21:27:24+00:00","triaged_at":"2026-11-13T21:29:36+00:00","updated_at":"2026-11-13T21:29:36+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T21:29:36Z","model":"claude-haiku-5-5","output":{"fix":"- Budget Board: upgrade to `3.6.2` or later.","reach":"internet","title":"Budget Board: OIDC login signs into accounts by unverified email","impact":"high","summary":"Budget Board's OIDC login matches existing local accounts by the email address in the identity provider's token without checking email_verified. If the configured identity provider lets someone register or display an email they do not own, an attacker can sign into the victim's Budget Board account, including linked bank data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["budget-board","self-hosted","oidc"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over victim accounts and reads linked bank data","analyst_note":"","how_to_check":"- Check the installed version: Budget Board earlier than `3.6.2` is affected.\n- Check whether OIDC login is enabled in the Budget Board configuration.\n- Check whether the OIDC provider allows users to register or set an email address without verifying it.","plain_action":"","product_name":"Budget Board","needs_analyst":false,"not_affected_if":["local-auth-only","verified-email-idp","version-3.6.2-or-later"],"who_is_affected":"Exposure requires Budget Board before 3.6.2 with OIDC login enabled, and an identity provider that lets users claim an email address without verifying it. Instances that use only local accounts, or an identity provider that enforces verified emails, are not exposed to this path.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001116,"input_tokens":4664,"output_tokens":1299,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-68551':13A,16A '3.6.2':98C,189C 'account':7A,35B,76B,112C,175C 'address':39B,118C,149C 'allow':140C 'app':85C 'assert':119C 'attack':67B,156C 'bank':79B,180C 'board':2A,18A,21B,28B,75B,82C,100C,174C 'budget':1A,17A,20B,27B,74B,81C,99C,173C 'budget-board':19B 'check':47B,128C 'claim':133C 'configur':52B,136C 'cve':11A,14A 'data':80B,181C 'display':59B,146C 'email':10A,38B,48B,61B,117C,131C,148C,164C 'ever':139C 'exist':33B,110C,172C 'financi':93C 'find':105C 'flow':104C 'get':166C 'goal':94C 'host':26B 'ident':42B,53B,122C 'includ':77B,176C 'issu':183C 'let':55B 'link':78B,179C 'local':34B,111C 'login':4A,31B,103C 'match':32B,115C 'month':88C 'never':127C 'oidc':3A,22B,30B,102C,137C 'patch':186C 'prior':95C 'prove':151C 'provid':43B,54B,123C,138C 'pure':113C 'regist':57B,144C,158C 'self':25B 'self-host':24B 'sign':5A,69B,107C,167C 'someon':56B 'spend':89C 'standard':130C 'token':45B,125C 'toward':92C 'track':87C 'unverifi':9A 'use':160C 'user':142C 'verifi':49B,132C 'version':97C,188C 'victim':72B,162C,170C 'without':46B,150C 'work':91C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires Budget Board before 3.6.2 with OIDC login enabled, and an identity provider that lets users claim an email address without verifying it. Instances that use only local accounts, or an identity provider that enforces verified emails, are not exposed to this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["board","budgetboard"],"ptokens":["board","budget"],"labels":["budgetboard","high","oidc","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-68551':13A,16A 'account':7A 'board':2A,18A 'budget':1A,17A 'cve':11A,14A 'email':10A 'login':4A 'oidc':3A 'sign':5A 'unverifi':9A","search_b":"'account':35B,76B 'address':39B 'attack':67B 'bank':79B 'board':21B,28B,75B 'budget':20B,27B,74B 'budget-board':19B 'check':47B 'configur':52B 'data':80B 'display':59B 'email':38B,48B,61B 'exist':33B 'host':26B 'ident':42B,53B 'includ':77B 'let':55B 'link':78B 'local':34B 'login':31B 'match':32B 'oidc':22B,30B 'provid':43B,54B 'regist':57B 'self':25B 'self-host':24B 'sign':69B 'someon':56B 'token':45B 'verifi':49B 'victim':72B 'without':46B","search_c":"'3.6.2':98C,189C 'account':112C,175C 'address':118C,149C 'allow':140C 'app':85C 'assert':119C 'attack':156C 'bank':180C 'board':82C,100C,174C 'budget':81C,99C,173C 'check':128C 'claim':133C 'configur':136C 'data':181C 'display':146C 'email':117C,131C,148C,164C 'ever':139C 'exist':110C,172C 'financi':93C 'find':105C 'flow':104C 'get':166C 'goal':94C 'ident':122C 'includ':176C 'issu':183C 'link':179C 'local':111C 'login':103C 'match':115C 'month':88C 'never':127C 'oidc':102C,137C 'patch':186C 'prior':95C 'prove':151C 'provid':123C,138C 'pure':113C 'regist':144C,158C 'sign':107C,167C 'spend':89C 'standard':130C 'token':125C 'toward':92C 'track':87C 'use':160C 'user':142C 'verifi':132C 'version':97C,188C 'victim':162C,170C 'without':150C 'work':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T02:46:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68551","severity":null,"published_at":"2026-11-13T20:19:00+00:00","modified_at":"2026-11-13T20:19:00+00:00","first_seen_at":"2026-11-13T21:27:24+00:00","fetched_at":"2026-11-13T21:27:24+00:00","note":null}],"documents":[{"id":149751,"url":"https://github.com/teelur/budget-board/commit/8c050368e6a01c72f41ab39be913fbf95f1cb253","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":149752,"url":"https://github.com/teelur/budget-board/releases/tag/v3.6.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":149753,"url":"https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T02:46:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}