CVE-2026-51584: Usememos vulnerability

Published Aug 11, 2026

Updated

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.

Affected Software

1 affected component

usememos=0.27.1

Event History

Aug 11, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2026-51584?

The severity of CVE-2026-51584 is rated at 72, indicating a high risk of exploitation.

How do I fix CVE-2026-51584?

To fix CVE-2026-51584, update to the latest version of usememos that addresses this vulnerability.

What vulnerability does CVE-2026-51584 exploit?

CVE-2026-51584 exploits an issue in usememos that allows remote attackers to achieve account takeover via improper SSO credential handling.

Who is affected by CVE-2026-51584?

Users of usememos version 0.27.1 are affected by CVE-2026-51584.

What is the main issue described in CVE-2026-51584?

The main issue in CVE-2026-51584 is that SSO identity is matched only on an attacker-controllable identifier, leading to potential account takeover.

CVE-2026-51584: Usememos vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-51584?

How do I fix CVE-2026-51584?

What vulnerability does CVE-2026-51584 exploit?

Who is affected by CVE-2026-51584?

What is the main issue described in CVE-2026-51584?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-51584?

How do I fix CVE-2026-51584?

What vulnerability does CVE-2026-51584 exploit?

Who is affected by CVE-2026-51584?

What is the main issue described in CVE-2026-51584?