The vulnerability, identified as CVE-2026-51584, exists in usememos v0.27.1 and allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go. This issue arises because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim. The affected product is usememos v0.2 [truncated]
The Memos webhook dispatch function safeDialContext() is vulnerable to a time-of-check/time-of-use DNS-rebinding bypass of the SSRF protection. This occurs because the function resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP [truncated]
