Databasement (< 1.10.9) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/databasement--1.10.9/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 14:47:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDatabasement: Authentication bypass in OAuthService (CVE-2026-121939)https://feed.craftedsignal.io/briefs/2026-11-databasement-auth-bypass/Wed, 04 Nov 2026 14:47:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-databasement-auth-bypass/Databasement versions prior to 1.10.9 contain an authentication bypass vulnerability where unverified OIDC emails are linked to local accounts, allowing attackers to assume control of administrative accounts.Databasement before version 1.10.9 contains an authentication bypass vulnerability in the OAuthService::findOrCreateLocalUser() method. The application fails to validate the email_verified claim when linking OIDC identities to local users, allowing an attacker to associate an identity provider account with a victim's email address and authenticate as that user. This allows an attacker to take over any local account, including super-admin accounts, and maintain access even after password resets.

Impact

Successful exploitation allows for unauthorized authentication as any system user, including accounts with administrative privileges, leading to full account takeover and persistent unauthorized access.

Recommendation

Update Databasement to version 1.10.9 or later to remediate the vulnerability in OAuthService::findOrCreateLocalUser().

]]>highadvisoryauthentication-bypassidentity-takeoveroidcweb-security