Improper Authentication Vulnerability in Nerves Hub by Nerves Project
CVE-2026-120999

7.4HIGH

Key Information:

Vendor

Nerves-hub

Status
Nerves Hub Web
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120999?

An improper authentication flaw in Nerves Hub allows attackers to hijack user accounts by exploiting Google sign-in and email confirmation processes. When an attacker registers a victim's email, they can gain access to that account without the victim verifying ownership. This vulnerability permits unauthorized linking of accounts and bypasses crucial email confirmation checks, enabling account takeover when legitimate users attempt to log in or confirm links. It is a serious concern that affects Nerves Hub versions from 2.3.0 to before 2.5.3.

Affected Version(s)

nerves_hub_web 2.3.0 < 2.5.3

nerves_hub_web 2.3.0 < 2.5.3

nerves_hub_web 74982672ab914bd6f37c3bc0e24a06e3474fa030 < 54dbf93c3bd323df08223a853c9afcf0b4dbf8e4

References

https://github.com/nerves-hub/nerves_hub_web/security/adv...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-120999.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-120999
related

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Josh Kalderimis
Jonatan Männchen / EEF
.