https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 05:49:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120999 <p>Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person&#39;s email address to share that person&#39;s account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account&#39;s owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account&#39;s email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address&#39;s owner signs in with Google or follows the confirmation link, they land in that account.</p> <p>The Google path also creates accounts with registrations closed and never checks Google&#39;s email_verified claim, and the API&#39;s password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path.</p> <p>This issue affects nerves_hub: from 2.3.0 before 2.5.3.</p> <p>Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person&#39;s email address to share that person&#39;s account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account&#39;s owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account&#39;s email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address&#39;s owner signs in with Google or follows the confirmation link, they land in that account.</p> <p>The Google path also creates accounts with registrations closed and never checks Google&#39;s email_verified claim, and the API&#39;s password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path.</p> <p>This issue affects nerves_hub: from 2.3.0 before 2.5.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120999