CVE-2026-111639

HIGH 8.1

bbs-go through 4.4.6 Account Takeover via Google One Tap Login

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

CWE	CWE-287
Vendor	mlogclub
Product	bbs-go
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for mlogclub bbs-go

Be the first to know when new high vulnerabilities affecting mlogclub bbs-go are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

mlogclub / bbs-go

0 ≤ 4.4.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover github.com: https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/pkg/google/jwt.go#L55-L58 github.com: https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/third_user_service.go#L274-L293 vulncheck.com: https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-account-takeover-via-google-one-tap-login

Credits

hieuPenguinnn