CVE-2026-126801

HIGH 8.8

Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.

CWE	CWE-639
Vendor	rabithua
Product	rote
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for rabithua rote

Be the first to know when new high vulnerabilities affecting rabithua rote are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Rabithua / Rote

1.2.0 ≤ 2.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Rabithua/Rote/pull/420 github.com: https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b github.com: https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659 vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261104/rote/ vulncheck.com: https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint

Credits

Wu Yulun