Authentication Bypass Vulnerability in Databasement by David-Crty

CVE-2026-121939

What is CVE-2026-121939?

Databasement versions prior to 1.10.9 contain a critical authentication bypass issue within the OAuthService::findOrCreateLocalUser() function. This vulnerability enables attackers to link OpenID Connect (OIDC) identities to local user accounts using email addresses without verifying if the email address is confirmed. Consequently, an attacker can create an identity provider account with a victim's unverified email, allowing unauthorized access to any user account—including those with super-admin privileges. The security risk is underscored by the potential for attackers to maintain access even after password resets.

References