CVE-2026-10130 is an authentication bypass vulnerability in FalkorDB's QueryWeaver component. The flaw arises because the signup route uses a Cypher MERGE operation to create and link a session token to an identity before checking if the email belongs to an existing account. This logic error allows attackers to submit a signup request with a known victim email address and receive a valid authenticated session token for that victim's account without needing any credentials or interaction from the victim.

An attacker can gain unauthorized access to existing user accounts by obtaining valid session tokens without authentication. This compromises confidentiality by allowing access to victim accounts, with limited integrity impact and no denial of service indicated. The vulnerability has a high severity with a CVSS score of 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a fix is available, restrict access to the signup endpoint if possible and monitor for suspicious signup activity involving known email addresses.