Vulnerability in Coop Moderation Tool from ROOST Allows Cross-Tenant Account Takeover
CVE-2026-63398

7.4HIGH

Key Information:

Vendor

Roostorg

Status
Coop
Vendor
CVE Published:
30 October 2026

What is CVE-2026-63398?

The Coop moderation tool by ROOST has a vulnerability in its SAML strategy's verify callback that could lead to cross-tenant account takeover. Prior to version 1.0.2, the system resolved authenticated users solely by email via kyselyUserFindByEmail without considering the organization context during the SAML login callback. This weakness allows an attacker managing one organization and possessing its SAML IdP signing key to issue claims for a victim's email to another organization sharing the same signing certificate. If exploited, this could result in unauthorized user session creation within the target organization, thus compromising its account without requiring privileges. The issue has been rectified in version 1.0.2.

Affected Version(s)

coop < 1.0.2

References

https://github.com/roostorg/coop/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/roostorg/coop/pull/783
x_refsource_MISC
https://github.com/roostorg/coop/commit/d1be81b6b33abc116...
x_refsource_MISC

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.