CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Attackers can take over accounts by exploiting unverified email matching in Gitea or self-managed GitLab OAuth integrations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105640?
CVE-2026-105640 is a critical authentication bypass vulnerability in makeplane plane, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Which versions are affected by CVE-2026-105640?
How do I fix CVE-2026-105640?
No fix has been published for CVE-2026-105640 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105640 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105640 exists.
Sources
Also known as GHSA-7j95-vh8g-f365.