CVE-2026-111639 mlogclub CVE debrief

Who should care

Defenders responsible for bbs-go deployments should assess exposure and prioritize verification and remediation to prevent potential security risks. This includes reviewing the current version of bbs-go, identifying exposed systems, and implementing compensating controls while remediation is scheduled and verified. Security teams should also monitor for suspicious login activity and track exceptions to ensure the vulnerability is properly addressed.

Why it matters

CVE-2026-111639 is an authentication bypass vulnerability in bbs-go through version 4.4.6, allowing remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Defenders responsible for bbs-go deployments should assess exposure and prioritize verification and remediation.

• Potential unauthorized access to user accounts
• Possible lateral movement within the affected system
• Required verification of user authentication mechanisms
• Potential data breaches or unauthorized data access

Technical summary

The vulnerability exists in the /api/login/google_one_tap endpoint of bbs-go through version 4.4.6, where the aud claim is never checked. This allows attackers to capture a victim's Google-signed ID token and replay it to obtain an authenticated session as the victim's Google-linked account. The vulnerability enables remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Defenders should prioritize verifying and upgrading to a fixed version of bbs-go, if available, and implement additional authentication checks to mitigate the vulnerability.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of bbs-go, if available, and implement additional authentication checks.

Recommended defensive actions

• Verify and upgrade to a fixed version of bbs-go, if available
• Implement additional authentication checks for Google One Tap Login
• Monitor for suspicious login activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the /api/login/google_one_tap endpoint, where the aud claim is never checked, allowing attackers to capture and replay Google-signed ID tokens to obtain an authenticated session as the victim's Google-linked account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.