CVE-2026-126801
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.
References
- https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659
- https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b
- https://github.com/Rabithua/Rote/pull/420
- https://vul.yulun.ac.cn/20261104/rote/
- https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint