{"id":"CVE-2026-121939","title":"Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking","summary":"Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity pr…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-290"],"vendor":"David-Crty","product":"Databasement","affected":["Databasement < 1.10.9"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-04T18:54:13.039388Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:54:39.641Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121939","references":[{"url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-mh6w-2cch-w8v8","label":"GitHub Security Advisory (GHSA-mh6w-2cch-w8v8)"},{"url":"https://github.com/David-Crty/databasement/commit/b7f4079c02b7ce3f1cf2844de182e809636c3382"},{"url":"https://github.com/David-Crty/databasement/releases/tag/v1.10.9","label":"Databasement v1.10.9 Release Notes"},{"url":"https://github.com/David-Crty/databasement/blob/v1.10.8/app/Services/OAuthService.php#L55-L68"},{"url":"https://www.vulncheck.com/advisories/databasement-before-1.10.9-account-takeover-via-oidc-email-auto-linking","label":"VulnCheck Advisory: Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-05T21:36:00.509Z","epss":0.00544,"epssPercentile":0.45902,"slug":"CVE-2026-121939","body":"## Overview\n\nDatabasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.\n\n## Affected\n\n- `Databasement < 1.10.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}