{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abbs-gobbs-go/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bbs-go:bbs-go:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-111639"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["bbs-go (\u003c= 4.4.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe bbs-go application, in versions through 4.4.6, contains a critical authentication bypass vulnerability identified as CVE-2026-111639. The vulnerability exists within the /api/login/google_one_tap endpoint, which handles Google One Tap authentication. The application fails to verify the 'aud' (audience) claim within the Google-issued ID token provided during the authentication flow.\u003c/p\u003e\n\u003cp\u003eBy default, Google ID tokens are scoped to the specific OAuth client ID that requested them. Because bbs-go neglects to validate that the 'aud' claim matches its own registered client ID, an attacker can create their own Google OAuth client and obtain an ID token. An attacker can then replay a victim's Google ID token - or use a token issued to the attacker's own client - to successfully authenticate as the victim's Google-linked account. This flaw allows for full account takeover of any user associated with a Google identity, posing a significant risk to user confidentiality and account integrity.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in unauthorized access to user accounts. An attacker can impersonate any user who has linked a Google account to their bbs-go profile, gaining full access to the victim's data and account privileges. This vulnerability impacts all installations of bbs-go version 4.4.6 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade bbs-go to a patched version once available that implements strict validation of the 'aud' claim in Google ID tokens.\u003c/li\u003e\n\u003cli\u003eImplement monitoring on web access logs for the /api/login/google_one_tap endpoint to identify anomalies in successful login rates or unexpected 'aud' claims if logging allows inspection of the token payload.\u003c/li\u003e\n\u003cli\u003eReview audit logs for suspicious account modifications or unauthorized access patterns if the application logs identity provider information.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T18:47:39Z","date_published":"2026-10-16T18:47:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-bbs-go-auth-bypass/","summary":"The bbs-go application up to version 4.4.6 is vulnerable to an authentication bypass via the /api/login/google_one_tap endpoint due to missing validation of the Google ID token audience claim.","title":"Authentication Bypass in bbs-go via Improper OAuth Token Validation","url":"https://feed.craftedsignal.io/briefs/2026-10-bbs-go-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:bbs-Go:bbs-Go:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}