External risk intelligence

Databasement OAuthService Authentication Bypass Leads to Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-121939

The vulnerability exists in an OAuth service integration responsible for handling user authentication and identity provider linking. Because OAuth and OIDC services are commonly implemented to facilitate public-facing web application logins and identity management, they are typically internet-accessible by design in order to interact with external identity providers.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Databasement's OAuth service that allows an attacker to bypass authentication by linking an identity provider account with a victim's unverified email address. This could enable unauthorized access to user accounts, including administrative privileges, even after password resets.

Unverified emails can grant attacker access.
It allows unauthorized access to any user account.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker can initiate an attack by registering an identity provider account using a victim's unverified email address. This allows them to bypass authentication and log in as any user, including administrative accounts. The vulnerability persists even after password resets, giving the attacker continued unauthorized access.

Requires attacker-controlled identity provider.
Links OIDC identities without verifying email.
Enables account takeover and persistent access.

Live Threat

Current exploitation, exposure, and threat context

An attacker could potentially bypass authentication by linking a victim's unverified email address to an attacker-controlled identity provider account. This could allow an attacker to impersonate any user, including administrators, and maintain access even after a password reset, when supported by the advisory.

User accounts and administrative access.
Linking unverified victim emails to attacker accounts.
Unauthorized access and account control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Databasement OAuth service's authentication bypass vulnerability requires an attacker to control an unverified email address. This could impact application owners responsible for user identity management and platform teams maintaining authentication services. The first practical step is to identify all instances of Databasement, determine their exposure to the internet and business criticality, and locate the accountable owners for each.

Identify accountable Databasement owners.
Verify external access and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Databasement?

Databasement is a software application or component that provides identity management services, specifically handling OAuth and OpenID Connect (OIDC) authentication. It allows users to log into systems by linking external identity provider accounts to local user profiles, managing how credentials and access rights are assigned within an organization's ecosystem.

How does the authentication bypass in CVE-2026-121939 work?

This vulnerability is classified as CWE-290, which involves an authentication bypass by assuming the identity of another user. In Databasement, the system incorrectly trusts incoming emails from external providers without verifying if the user actually owns that email address. An attacker exploits this by registering an account with a target's email at an identity provider, tricking the software into linking that identity to the victim's existing local account.

Do I need a specific setup for this vulnerability to be triggered?

Yes, an attacker must be able to control or register an identity at a provider that communicates with your Databasement instance. The vulnerability specifically relies on the software's failure to check the 'email_verified' status during the linking process. It is not triggered if your authentication flow requires verified email addresses or if the OIDC provider's trust configuration prevents unverified email association.

Is my Databasement instance at risk if it is internal?

According to Halo Surface Signal, this vulnerability is most relevant to public-facing applications because OAuth and OIDC services are typically designed to reach out to external providers. If your instance is not exposed to the internet or does not allow third-party identity provider logins, the attack path is significantly harder to execute, though you should still assess the service's role within your internal authentication chain.

What should I do if I am running Databasement?

Begin by identifying all running instances of Databasement within your infrastructure and determining which ones are connected to the internet or handle sensitive user data. Once you have a list of deployments and their accountable owners, prioritize assessing them for potential exposure and plan for updates to a version where this identity linking logic has been secured.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.