CVE-2026-111639
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Remote attackers can hijack any Google-linked user account and gain full session access. To pull this off, the attacker needs their own Google OAuth client to obtain an ID token from the victim and submit it to the target application.
Root cause
The /api/login/google_one_tap endpoint validates Google ID tokens without checking the 'aud' (audience) claim, allowing token replay from any Google OAuth client.
Affected systems
bbs-go through 4.4.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
No patched version is specified in the advisory; block or disable the /api/login/google_one_tap endpoint at your reverse proxy (e.g., Nginx) or turn off Google One Tap login until a patch checking the aud claim is deployed.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
References
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/pkg/google/jwt.go#L55-L58
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/third_user_service.go#L274-L293
- https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover
- https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-account-takeover-via-google-one-tap-login