CVE-2026-105640

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description Plane trusts email addresses returned by Gitea OAuth and self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which the system matches directly to the victim's existing local account. This allows an attacker to log in to the victim's account without knowing the password.

Recommendations Update to version 1.4.0.