Rote: Authorization bypass in OAuth bind/merge endpoint (CVE-2026-126801)
Rote versions 1.2.0 through 2.6.0 are vulnerable to an authorization bypass in the OAuth bind/merge endpoint that allows authenticated attackers to hijack, manipulate, and delete arbitrary user accounts.
CVE search metadata
CVE search record: CVE-2026-126801. Severity: high. CVSS: 8.8. KEV: no. Product: Rote (1.2.0 through 2.6.0). Brief: Rote: Authorization bypass in OAuth bind/merge endpoint (CVE-2026-126801). Brief link: https://feed.craftedsignal.io/briefs/2026-11-rote-auth-bypass-cve-2026-126801/
Triage facts
Revision 1- Applicability
- Rote (1.2.0 through 2.6.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Rote versions 1.2.0 through 2.6.0 contain an authorization bypass vulnerability in the OAuth bind/merge endpoint (CVE-2026-126801). The vulnerability allows an authenticated attacker to merge any OAuth-bound account into their own by submitting a public 'existingUserId' along with a target GitHub or Apple user ID. Successful exploitation grants the attacker full access to the victim's notes, attachments, and API keys, and permits the deletion of the victim's account.
Impact
Successful exploitation results in full account takeover, unauthorized access to sensitive user data, and the potential for account destruction. The CVSS 3.1 base score is 8.8.
Recommendation
Update Rote instances to a version later than 2.6.0. Organizations should audit OAuth integration logs for anomalous merge activity or unexpected 'existingUserId' values in bind requests until the patch is applied.
Immediate actions
Inventory all internal Rote instances and verify version numbers.
Threat Hunt
Search application logs for requests to the OAuth bind/merge endpoint where the 'existingUserId' parameter does not match the session owner's ID.
Data: Web application server logs, OAuth API request logs
Mitigations
Upgrade Rote to a version beyond 2.6.0.
CVE-2026-126801