Is CVE-2026-111639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111639 being exploited in the wild.

How severe is CVE-2026-111639?

High severity, with a CVSS score of 8.1, published 16 October 2026.

Is there a fix for CVE-2026-111639?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111639 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111639?

Check whether you run Mlogclub Bbs-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111639: bbs-go authentication bypass in Google One Tap

CVE-2026-111639 · Severity: high · CVSS 8.1 · Published 2026-10-16

bbs-go is an open-source bulletin board forum platform that allows users to log in via Google accounts. This vulnerability allows an attacker to bypass authentication and log in as any user by replaying a victim's Google sign-in token. An attacker can hijack user accounts and access the victim's forum posts, private messages, and profile information.

Technologies: Mlogclub Bbs-Go. Vendors: Mlogclub.

Quick answers

Is CVE-2026-111639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111639 being exploited in the wild.
How severe is CVE-2026-111639?: High severity, with a CVSS score of 8.1, published 16 October 2026.
Which products and versions are affected?: Mlogclub Bbs-Go through 4.4.6.
Is there a fix for CVE-2026-111639?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111639 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111639?: Check whether you run Mlogclub Bbs-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /api/login/google_one_tap endpoint fails to validate the aud (audience) claim in Google-issued ID tokens. An attacker operating their own Google OAuth client can capture a victim's ID token and replay it to obtain an authenticated session as that user. The vulnerability stems from incomplete JWT validation in the token verification logic, allowing token reuse across different OAuth clients.

Affected products

mlogclub bbs-go through 4.4.6

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.