# CVE-2026-120999: NervesHub improper authentication in sign-in and email confirmation

Source: https://junglewise.ai/threats/cve-2026-120999-improper-authentication-vulnerability-in-google-sign-in-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120999 · Severity: info · Published 2026-11-10

NervesHub is a device management and firmware deployment platform for Elixir and Nerves devices. An authentication flaw allows an attacker to register another person's email address and gain access to that person's account when they attempt to sign in via Google or use email confirmation links. The attacker can then access any resources the legitimate user is granted within the platform.

Technologies: [NervesHub Nerves Hub Web](https://junglewise.ai/threats/technologies/nerves-hub-web). Vendors: [NervesHub](https://junglewise.ai/threats/vendors/nerveshub).

## Quick answers

**Is CVE-2026-120999 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120999 being exploited in the wild.

**How severe is CVE-2026-120999?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** NervesHub Nerves Hub Web 2.3.0 before 2.5.3.

**Is there a fix for CVE-2026-120999?** Yes: fixed in 2.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120999 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120999?** Check whether you run NervesHub Nerves Hub Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.3

## Technical details

The vulnerability exists in two code paths: update_or_create_user_from_ueberauth/1 auto-links unverified Google accounts to existing accounts with matching email addresses without requiring proof of email ownership, and SessionController.confirm/2 signs in any user who clicks a confirmation link. An attacker can register a victim's email, change their own account's email to it via account settings or organization invites, and retain the password; when the victim signs in, they land in the attacker's account. The Google path also fails to check Google's email_verified claim and creates accounts with closed registrations. No network access or user interaction beyond normal sign-in is required beyond the initial registration.

## Affected products

- NervesHub nerves_hub_web 2.3.0 before 2.5.3

## Timeline

- 2026-11-10: disclosed

## References

- [https://ghcr.io/](https://ghcr.io/)
- [https://github.com/](https://github.com/)

## Related threats

- [NervesHub cross-organization data access via object attribute injection](https://junglewise.ai/threats/cve-2026-120730-improperly-controlled-modification-of-dynamically-determined)
- [NervesHub nerves_hub_web incorrect authorization in bulk move](https://junglewise.ai/threats/cve-2026-120295-incorrect-authorization-vulnerability-in-the-devices-page-bulk)
- [nerves_hub_web session fixation in CLI login](https://junglewise.ai/threats/cve-2026-119446-session-fixation-vulnerability-in-the-cli-login-flow-in-nerves)