CVE-2026-111639 Details

An authentication bypass vulnerability has been identified in bbs-go versions through 4.4.6, specifically in the /api/login/google_one_tap endpoint. This vulnerability allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers who control their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the audience claim is not verified, to gain access to the victim's Google-linked account.

The vulnerability can be fixed by adding a check to ensure that the audience claim of the ID token matches the site's Google OAuth client ID, and by enforcing the token's expiration time. Additionally, ID tokens could be verified against Google's published keys to ensure their integrity and validity before being accepted.