CVE-2026-89022: BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driverid namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BookStackto a version that resolves this vulnerability.Fixed in 26.05.5
Event History
Frequently Asked Questions
What deployment conditions are required for exploitation?
The instance must have social login providers enabled such that an attacker can authenticate through one provider while a target account is linked through a different provider sharing the same driver_id namespace.
What does an attacker need to do to exploit this issue?
The attacker needs no existing BookStack account. They must be able to authenticate with an enabled social provider using a user ID that matches a BookStack account linked to another social provider.
What version should be deployed to address the issue?
Upgrade BookStack to version 26.05.5 or later.