CVE-2026-111639highCWE-287

CVE-2026-111639: high-severity vulnerability in mlogclub bbs-go

bbs-go through 4.4.6 Account Takeover via Google One Tap Login

Published · Updated

Follow this CVE+ Monitor bbs-go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
mlogclub · bbs-go
Related CVEs — mlogclub bbs-go

In the same product, most dangerous first.

CVE-2026-103396MEDIUMbbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccountEPSS 0.3%CVE-2026-110103MEDIUMbbs-go through 4.4.6 Stored XSS via Image Upload Content-TypeEPSS 0.2%CVE-2026-121452HIGHbbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email ServiceEPSS —