Databasement OIDC email auto-linking allows account takeover

Attackers can log in to a database management web app as other users.

Summary

Databasement links a login from an identity provider to a local account by matching email, without checking that the email is verified. Attackers can log in as any user, including the super-admin. Versions before 1.10.9 are affected.

Affected when

OIDC login enabled
Automatic linking by email turned on (default)
Identity provider allows accounts with unverified email

What to do

Update to version 1.10.9 or later.

Products and platforms

Databasement

CVE IDs

CVE-2026-121939 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 12:31 UTC

First seen 2026-11-09 15:20 UTC