High severity8.8NVD Advisory· Published Nov 11, 2026
CVE-2026-126801
CVE-2026-126801
Description
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.tsnvd
- github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22bnvd
- github.com/Rabithua/Rote/pull/420nvd
- vul.yulun.ac.cn/20261104/rote/nvd
- www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpointnvd
News mentions
0No linked articles in our index yet.