CVE-2026-89022
HIGH · 7.4accurate vulnerability chatter, no confirmed exploitation or KEV, but active advisory.
What: BookStack before 26.05.5 has an authentication bypass in social login; attackers can sign in as any user by exploiting driver_id namespace collision across different social providers (CVSS 7.4).
Why it matters: Same-day advisory with working vulnerability logic published; no KEV listing yet but likely forthcoming. Core auth bypass affecting multi-tenant or organization deployments. Patch (26.05.5) is available. No confirmed in-the-wild exploitation reported in posts, but social chatter is active and accurate.
Where it's seen: Security social media (Bluesky) circulating NVD description and advisory; one post inflates CVSS to 9.1 (misreporting). No PoC code shared, no defender triage signals yet.
RISK: HIGH — authentication bypass on day one; patch available but adoption unclear.
Description
BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- Attack vector
- Network
- Complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None