CVE-2026-121939criticalCWE-290

CVE-2026-121939: critical vulnerability in David-Crty Databasement

Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking

Published

Follow this CVE+ Monitor databasement

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
David-Crty · Databasement
Related CVEs — David-Crty Databasement

In the same product, most dangerous first.

CVE-2026-95654CRITICALDatabasement before 1.7.14 Authorization Bypass via Stale Invitation TokenEPSS 0.5%CVE-2026-111875MEDIUMDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorizationEPSS 0.2%