GHSA-5fvm-xr9w-32vjHighCVSS 8.8
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that...
🔗 CVE IDs covered (1)
📋 Description
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-126801
- https://github.com/Rabithua/Rote/pull/420
- https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b
- https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659
- https://vul.yulun.ac.cn/20261104/rote
- https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint
- https://github.com/advisories/GHSA-5fvm-xr9w-32vj