CVE-2026-120999
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-287
Autenticación incorrecta
Fecha de publicación:
10/11/2026
Última modificación:
10/11/2026
Descripción
*** Pendiente de traducción *** Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person&#39;s email address to share that person&#39;s account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account&#39;s owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account&#39;s email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address&#39;s owner signs in with Google or follows the confirmation link, they land in that account.<br />
<br />
The Google path also creates accounts with registrations closed and never checks Google&#39;s email_verified claim, and the API&#39;s password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path.<br />
<br />
This issue affects nerves_hub: from 2.3.0 before 2.5.3.
Impacto
Puntuación base 4.0
7.40
Gravedad 4.0
ALTA
Referencias a soluciones, herramientas e información
- https://cna.erlef.org/cves/CVE-2026-120999.html
- https://github.com/nerves-hub/nerves_hub_web/commit/54dbf93c3bd323df08223a853c9afcf0b4dbf8e4
- https://github.com/nerves-hub/nerves_hub_web/commit/74982672ab914bd6f37c3bc0e24a06e3474fa030
- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-r92p-gg92-gmwm
- https://osv.dev/vulnerability/EEF-CVE-2026-120999