CVE-2026-121939

Name of the Vulnerable Software and Affected Versions Databasement versions prior to 1.10.9

Description An authentication bypass exists in the OAuthService::findOrCreateLocalUser() function. The system links OpenID Connect (OIDC) identities to local users based on email addresses without verifying if the email verified status is true. This allows a remote attacker to register an account with an identity provider using a victim's unverified email to gain unauthorized access to any local account, including super-admin privileges, and maintain access even after password resets.

Recommendations Update to version 1.10.9.