CVE-2026-111639

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111639
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111639.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111639
Published
2026-10-16T17:39:10Z
Modified
2026-10-28T02:30:38Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
bbs-go through 4.4.6 Account Takeover via Google One Tap Login
Details

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111639.json"
}
References

Affected packages

Git / github.com/mlogclub/bbs-go

Affected ranges

Type
GIT
Repo
https://github.com/mlogclub/bbs-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
7745195925f2094d1f37a1d7bbf13837fa948898
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "4.4.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "4.4.6"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

3.*
3.3.2
3.5.4
v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v2.*
v2.0.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.5.6
v4.*
v4.0.0
v4.0.0-beta1
v4.0.0-beta2
v4.0.1
v4.0.3
v4.0.5
v4.0.6
v4.1.0
v4.1.1
v4.1.2
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.9
v4.4.0
v4.4.0-rc4
v4.4.0-rc5
v4.4.1
v4.4.1-rc1
v4.4.1-rc2
v4.4.1-rc3
v4.4.1-rc4
v4.4.2
v4.4.2-rc1
v4.4.2-rc2
v4.4.2-rc3
v4.4.2-rc4
v4.4.2-rc5
v4.4.3
v4.4.3-rc1
v4.4.3-rc2
v4.4.3-rc3
v4.4.4
v4.4.5
v4.4.5-rc1
v4.4.5-rc2
v4.4.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111639.json"