CVE-2026-68551

{
  "etk_id": "ETK-2026-4422",
  "cve_id": "CVE-2026-68551",
  "display_id": "CVE-2026-68551",
  "ghsa_id": "GHSA-576g-r8m3-q9vp",
  "euvd_id": "EUVD-2026-125723",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OIDC email-verification bypass in budget-board",
  "summary": "budget-board versions before 3.6.2 can associate an OIDC login with an existing local account using an email address that has not been confirmed by the identity provider. An attacker may gain access to a victim's account and linked financial data if the configured OIDC provider permits users to claim email addresses without proving ownership.",
  "mitigation": "Upgrade budget-board to version 3.6.2. Until the upgrade is complete, configure the OIDC provider to require verified email addresses and prevent users from asserting unowned addresses.",
  "vendor": "teelur",
  "product": "budget-board",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.6.1"
      ],
      "ecosystem": "nuget",
      "fixed_versions": [
        "v3.6.2"
      ],
      "package_name": "BudgetBoard.WebAPI",
      "purl": "pkg:nuget/BudgetBoard.WebAPI"
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.85602335,
  "t0_at": "2026-11-13T19:14:35.246000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T19:14:35.246000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T19:14:35.246000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68551"
    }
  }
}