CVE-2026-120999

Name of the Vulnerable Software and Affected Versions nerves hub versions 2.3.0 through 2.5.2

Description Improper authentication in Google sign-in and email confirmation allows an attacker to share an account with another user by registering that user's email address first. The function NervesHub.Accounts.update or create user from ueberauth/1 signs in Google users to any account with the same email not yet linked to Google, marking the email as confirmed without proof of ownership. Similarly, NervesHubWeb.SessionController.confirm/2 signs in any user who follows a confirmation link. An attacker can register a victim's email via the sign-up form, change their own account email, or use an organization invite link while keeping the password. When the actual owner signs in via Google or a confirmation link, they are logged into the attacker's account. Additionally, the Google authentication path creates accounts even when registrations are closed and fails to check the email verified claim. The NervesHubWeb.API.UserController also issues tokens to accounts with unconfirmed emails.

Recommendations Update nerves hub to version 2.5.3. As a temporary mitigation, disable Google sign-in by unsetting the GOOGLE CLIENT ID variable. Restrict the use of the SIGN UP METHODS configuration to control how users register.