CVE-2026-121939: Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking emailverified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
Event History
Frequently Asked Questions
Which deployments are exposed?
Databasement versions before 1.10.9 are affected where OIDC authentication can link an identity to an existing local account by matching its email address. Accounts with high privileges, including the super-admin, can be targeted.
What does an attacker need to exploit this?
The attacker needs to register an identity-provider account using the victim's email address without having to prove ownership of that email. They can then use OIDC login to have that identity linked to the victim's local account.
Would changing a compromised user's password remove the attacker?
No. The vulnerability allows the attacker to retain access through the linked OIDC identity after password resets.
What should be done if an upgrade cannot happen immediately?
The provided information does not specify a workaround. Upgrading to version 1.10.9 is the documented fixed release.