CVE-2026-51584 in Memos
Summary
by MITRE • 08/11/2026
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the usememos application version 0.27.1 where a remote attacker can achieve account takeover through a flaw in the single sign-on authentication mechanism. This security weakness resides in the SignIn handler located at server/router/api/v1/auth_service.go and specifically affects the ssoCredentials branch of the authentication flow. The core issue stems from improper identity verification during the SSO login process where the system only validates against an attacker-controlled identifier rather than binding to the Identity Provider's stable subject claim that uniquely identifies users.
The technical flaw represents a critical authentication bypass vulnerability that allows malicious actors to impersonate legitimate users by manipulating the SSO identity matching process. When users authenticate through SSO, the application should verify that the incoming identity assertion corresponds to a valid user account within the system. However, in this case, the authentication handler performs verification solely against a controllable identifier field that attackers can manipulate, without ensuring proper binding to the stable subject identifier provided by the Identity Provider. This design flaw enables attackers to associate their malicious credentials with existing user accounts, effectively enabling unauthorized access and account takeover.
The operational impact of this vulnerability is severe as it allows remote attackers to gain unauthorized access to user accounts without requiring valid credentials or knowledge of existing passwords. Attackers can exploit this weakness by crafting SSO authentication responses that contain manipulated identifier values, thereby associating their malicious identities with legitimate user accounts. This creates a persistent threat where attackers can maintain access to compromised accounts and potentially escalate privileges within the application. The vulnerability affects all users who authenticate through SSO mechanisms, making it particularly dangerous for organizations relying heavily on federated identity solutions.
This vulnerability aligns with CWE-305 Authentication Bypass Through User Identification Error and maps to ATT&CK technique T1078 Valid Accounts where adversaries leverage compromised or forged authentication credentials to maintain persistent access. The flaw demonstrates a failure in proper identity assertion validation where the system does not implement adequate checks to ensure that SSO identities are properly bound to stable identifiers from the Identity Provider. Organizations should immediately implement mitigations including mandatory binding of SSO assertions to stable subject claims, implementing additional verification layers for identity assertions, and ensuring that all authentication flows properly validate user identities against authoritative sources rather than relying on attacker-controllable fields.
The recommended remediation involves modifying the SignIn handler to enforce strict validation of SSO identity assertions by requiring binding to the Identity Provider's stable subject claim before establishing user sessions. This implementation should include verification that the incoming identifier matches the expected stable identifier format and that the assertion originates from a trusted Identity Provider. Additionally, organizations should implement logging and monitoring for authentication events to detect suspicious activities related to account takeover attempts and establish proper access controls to prevent unauthorized modifications to user accounts during the SSO authentication process.