CVE-2026-50191 4gaBoards: Pre-Account Takeover via SSO Email Linkage
Attackers can hijack victim accounts by pre-registering with their email, gaining access to projects and data upon the victim's first SSO login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50191?
CVE-2026-50191 is a high-severity authentication bypass vulnerability in RARgames 4gaBoards, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.
Which versions are affected by CVE-2026-50191?
How do I fix CVE-2026-50191?
No fix has been published for CVE-2026-50191 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-50191 being exploited?
There is no known exploitation of CVE-2026-50191 in the wild and no public exploit code.
Sources
Also known as GHSA-f3p6-chc6-pc77.