CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121939?
CVE-2026-121939 is a critical vulnerability in David-Crty Databasement, published on 4 Nov 2026.
Official description
Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser() that links OIDC identities to local users by email without checking email_verified. Attackers can register an identity provider account with a victim's unverified email to log in as any user, including the super-admin, and retain access after password resets.
Weakness: CWE-290
Which versions are affected by CVE-2026-121939?
How do I fix CVE-2026-121939?
No fix has been published for CVE-2026-121939 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-121939 exists.
Sources
Also known as GHSA-3962-28xr-cf4g, GHSA-mh6w-2cch-w8v8.