Executive brief
QueryWeaver, an open-source tool that translates natural language into database queries, contains a flaw that allows unauthorized individuals to take over existing user accounts. By simply attempting to sign up with a known user's email address, an attacker can trick the system into providing a valid login session for that user. This allows the attacker to access sensitive data and perform actions as the victim without needing their password.
Technical details
An authentication bypass vulnerability exists in QueryWeaver's signup route due to incorrect authorization logic. The application uses a Cypher MERGE operation to unconditionally create and link a new session token to an Identity matching the provided email address before verifying if the account already exists. Consequently, an unauthenticated remote attacker can provide a victim's email address during the signup process to receive a valid authenticated session token. This allows for full account takeover without prior credentials or user interaction. The issue is fixed in version 0.3.1.
Affected products
- FalkorDB QueryWeaver <= 0.2.0
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory