CVE-2026-111639highCWE-287

CVE-2026-111639: fallo de gravedad alta en mlogclub bbs-go

bbs-go through 4.4.6 Account Takeover via Google One Tap Login

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear bbs-go

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.5%
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
mlogclub · bbs-go
CVEs relacionadas — mlogclub bbs-go

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-103396MEDIUMbbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccountEPSS 0.3%CVE-2026-121452HIGHbbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email ServiceEPSS 0.2%CVE-2026-110103MEDIUMbbs-go through 4.4.6 Stored XSS via Image Upload Content-TypeEPSS 0.2%