Skip to content
Threat Feed
Subscribe
high advisory PoC

Databasement: Authentication bypass in OAuthService (CVE-2026-121939)

Databasement versions prior to 1.10.9 contain an authentication bypass vulnerability where unverified OIDC emails are linked to local accounts, allowing attackers to assume control of administrative accounts.

CVE search metadata

CVE search record: CVE-2026-121939. Severity: high. CVSS: 8.1. KEV: no. Product: Databasement (< 1.10.9). Brief: Databasement: Authentication bypass in OAuthService (CVE-2026-121939). Brief link: https://feed.craftedsignal.io/briefs/2026-11-databasement-auth-bypass/

Triage facts

Revision 2
Applicability
Databasement (< 1.10.9)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 2Nov 4, 16:04 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

Databasement before version 1.10.9 contains an authentication bypass vulnerability in the OAuthService::findOrCreateLocalUser() method. The application fails to validate the email_verified claim when linking OIDC identities to local users, allowing an attacker to associate an identity provider account with a victim's email address and authenticate as that user. This allows an attacker to take over any local account, including super-admin accounts, and maintain access even after password resets.

Impact

Successful exploitation allows for unauthorized authentication as any system user, including accounts with administrative privileges, leading to full account takeover and persistent unauthorized access.

Recommendation

Update Databasement to version 1.10.9 or later to remediate the vulnerability in OAuthService::findOrCreateLocalUser().

Threat Hunt

Identify unusual OAuth login patterns where the OIDC identity email does not match verified domain ownership or shows rapid account linking activity.

T1550.001 medium medium confidence hunt now

Data: Application identity provider logs, Authentication event logs, OAuth account linking audit trails

Mitigations

Upgrade Databasement to version 1.10.9 or later.

immediate IT Operations

CVE-2026-121939