ETK-2026-640Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-640",
  "cve_id": null,
  "display_id": "ETK-2026-640",
  "ghsa_id": "GHSA-qjjc-q2h2-56cg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Improper OIDC account binding in AiSOC",
  "summary": "AiSOC versions before 17.0.0 can associate an OIDC login with an existing local account using an email claim that has not been verified. An attacker may gain access as that account, including its assigned permissions, when the configured identity provider permits an authenticated user to present a matching unverified email address.",
  "mitigation": "Upgrade AiSOC to version 17.0.0. Until upgrading, configure the identity provider to issue only verified email claims and restrict or disable OIDC sign-in where that cannot be enforced.",
  "vendor": "other",
  "product": "other:beenuar/AiSOC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 16.0.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "17.0.0"
      ],
      "package_name": "beenuar/AiSOC",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 27.73997795,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T09:03:41+00:00",
      "days": -15.86366689761574,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:21.842760+00:00",
      "url": "https://github.com/beenuar/AiSOC/security/advisories/GHSA-qjjc-q2h2-56cg"
    }
  }
}