Read the docs
TI-2026-75425 Aliases CVE-2026-111639GHSA-h5hh-rp4r-9p9x

bbs-go Account Takeover via Google One Tap Login

Priority HIGH 72CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

bbs-go through 4.4.6 contains an authentication bypass in the /api/login/google_one_tap endpoint that lets remote attackers log in as other users. The endpoint accepts Google ID tokens issued to any OAuth client because the aud claim is never checked. An attacker with their own Google OAuth client can capture a victim's Google-signed ID token and replay it to obtain an authenticated session as the victim's Google-linked account. The flaw is classified as improper authentication (CWE-287).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00473 41st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mlogclubbbs-goup to 4.4.6—No fix listedCNA
  • bbs-go Vendormlogclub Affected up to 4.4.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for bbs-go.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111639
  2. 2026-10-16 Alias added: GHSA-h5hh-rp4r-9p9x
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-21 CISA SSVC decision points changed
  5. 2026-10-21 Priority changed: LOW → HIGH

References

Advisory 1

Other 2

  • TI-2026-84345 Improper TLS certificate validation in bbs-go SMTP email service CVSS 4.0HIGH 8.3
  • TI-2026-65682 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount CVSS 4.0MEDIUM 5.3
  • TI-2026-71989 Stored cross-site scripting in bbs-go via spoofed upload Content-Type CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences