CVE-2026-111639: Improper Authentication in mlogclub bbs-go

CVE-2026-111639 describes an authentication bypass vulnerability in mlogclub bbs-go through version 4.4.6. The vulnerability exists in the /api/login/google_one_tap endpoint, where the application fails to verify the 'aud' claim in Google ID tokens. This allows attackers who control their own Google OAuth client to capture a victim's Google-signed ID token and replay it to the vulnerable endpoint. Because the 'aud' claim is not checked, the system accepts tokens issued to any OAuth client, enabling attackers to impersonate victims and obtain authenticated sessions linked to the victim's Google account.

Successful exploitation allows remote attackers to bypass authentication and log in as arbitrary users linked to Google accounts. This can lead to unauthorized access to user accounts and potentially sensitive information or functionality within the bbs-go application. The vulnerability has a high severity with a CVSS 4.0 base score of 8.6, indicating significant risk if exploited.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected Google One Tap login endpoint or implementing additional verification of the 'aud' claim in Google ID tokens to ensure tokens are issued for the intended OAuth client.