CVE-2026-68551
HIGH
MEDIUM
Priority: 0.00
BB Relevance:
77/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
Low
VA:
None
Description
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.
Weakness Classification (2)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| teelur | budget-board | < 3.6.2 |
| teelur | budget-board | < 3.6.2 |
References & Advisories (4)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM