{"id":"CVE-2026-126801","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-126801","summary":"Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers…","details":"Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.","published":"2026-11-11T21:16:43.670","modified":"2026-11-11T21:16:43.670","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b","label":"Rabithua/Rote@865d69f"},"references":[{"type":"WEB","url":"https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659"},{"type":"WEB","url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b"},{"type":"WEB","url":"https://github.com/Rabithua/Rote/pull/420"},{"type":"WEB","url":"https://vul.yulun.ac.cn/20261104/rote/"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T21:16:43.670"}}