mlogclub CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH mlogclub CVE published 2026-10-16

CVE-2026-111639

CVE-2026-111639 is an authentication bypass vulnerability in bbs-go through version 4.4.6, allowing remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. This vulnerability exists in the /api/login/google_one_tap endpoint, where the aud claim is never checked. Attackers can capture and replay Google-signed ID tokens to obtain an authenticated session as the v [truncated]