CVE-2026-111639
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the…
- Risk score
- 60/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/pkg/google/jwt.go#L55-L58
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/third_user_service.go#L274-L293
- https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover
- https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-account-takeover-via-google-one-tap-login
- https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover
Original description
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
Last activity 16 Oct 2026. Patch Forecast updates every hour.