Authentication Bypass in QueryWeaver by FalkorDB

CVE-2026-10130

What is CVE-2026-10130?

QueryWeaver presents an authentication bypass flaw that enables unauthenticated attackers to obtain valid session tokens through the submission of signup requests using existing victim email addresses. This vulnerability arises because the signup process fails to verify the existence of an account prior to token generation, which is done unconditionally via a Cypher MERGE operation. As a result, attackers can obtain valid session tokens linked to existing accounts without needing any credentials or prior interaction with the system.

References