---
id: "CVE-2026-68551"
page: "https://infrastack.ai/live/CVE-2026-68551"
kind: "vulnerability"
aliases: ["CVE-2026-68551"]
title: "Budget Board: OIDC login signs into accounts by unverified email"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Budget Board", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["budget-board", "oidc", "other", "self-hosted"]
not_affected_if: ["local-auth-only", "verified-email-idp", "version-3.6.2-or-later"]
published_at: "2026-11-13T20:19:00+00:00"
first_seen_at: "2026-11-13T21:27:24+00:00"
updated_at: "2026-11-13T21:29:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68551", "first_seen_at": "2026-11-13T21:27:24+00:00"}]
exploit_sources: []
---

# Budget Board: OIDC login signs into accounts by unverified email

Link for people: https://infrastack.ai/live/CVE-2026-68551 (this .md is for agents)

Budget Board's OIDC login matches existing local accounts by the email address in the identity provider's token without checking email_verified. If the configured identity provider lets someone register or display an email they do not own, an attacker can sign into the victim's Budget Board account, including linked bank data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Budget Board affected range not listed fixed no fixed version listed

## How to check

- Check the installed version: Budget Board earlier than `3.6.2` is affected.
- Check whether OIDC login is enabled in the Budget Board configuration.
- Check whether the OIDC provider allows users to register or set an email address without verifying it.

## Fix

- Budget Board: upgrade to `3.6.2` or later.

## Timeline

- 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68551

## Documents

- [advisory] Vendor advisory: github.com https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp
- [fix] Patch: github.com https://github.com/teelur/budget-board/commit/8c050368e6a01c72f41ab39be913fbf95f1cb253
- [fix] Release notes: github.com https://github.com/teelur/budget-board/releases/tag/v3.6.2

## From the sources

Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_