CVE-2026-126801

EUVD-2026-124016
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659
https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b
https://github.com/Rabithua/Rote/pull/420
https://vul.yulun.ac.cn/20261104/rote/
https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint