Summaryinfo

A vulnerability identified as critical has been detected in blinkospace blinko up to 1.8.3. Impacted is an unknown function of the component User Endpoint. Performing a manipulation of the argument originalPassword results in authentication bypass. This vulnerability is cataloged as CVE-2026-23480. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in blinkospace blinko up to 1.8.3. It has been classified as critical. This affects some unknown functionality of the component User Endpoint. The manipulation of the argument originalPassword with an unknown input leads to a authentication bypass vulnerability. CWE is classifying the issue as CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. This is going to have an impact on integrity. The summary by CVE is:

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an optional parameter and if not provided password verification is skipped; there is no check for input.id === ctx.id (ownership verification). This could result in any authenticated user modifying other users' passwords, direct escalation to superadmin, and complete account takeover. This issue has been patched in version 1.8.4.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-23480 since 01/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.8.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3afbdf486b6f371bdac5781dea6289749f2c4c03 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• blinkospace

Name

• blinko

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3

License

• open-source

Website

• Product: https://github.com/blinkospace/blinko/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion