Is CVE-2026-121939 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121939 being exploited in the wild.

How severe is CVE-2026-121939?

High severity, with a CVSS score of 8.1, published 4 November 2026.

Which products and versions are affected?

David-Crty Databasement before 1.10.9.

How is CVE-2026-121939 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121939?

Check whether you run David-Crty Databasement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121939: Databasement authentication bypass in OAuthService

CVE-2026-121939 · Severity: high · CVSS 8.1 · Published 2026-11-04

Databasement is a database management application that supports OAuth login. An authentication bypass flaw allows attackers to register an identity provider account with a victim's email address to gain access to that victim's account, including admin accounts, without requiring the email to be verified. After exploiting this, attackers retain access even if the victim changes their password.

Technologies: David-Crty Databasement. Vendors: David-Crty.

Quick answers

Is CVE-2026-121939 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121939 being exploited in the wild.
How severe is CVE-2026-121939?: High severity, with a CVSS score of 8.1, published 4 November 2026.
Which products and versions are affected?: David-Crty Databasement before 1.10.9.
Is there a fix for CVE-2026-121939?: Yes: fixed in 1.10.9. Until then: Disable the auto_link_by_email configuration option to prevent linking OIDC identities to existing local users by email alone. For OIDC providers that do not send email_verified claims (such as Entra ID), set OAUTH_OIDC_TRUST_EMAIL_WITHOUT_VERIFIED_CLAIM only after confirming the provider's security guarantees. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121939 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121939?: Check whether you run David-Crty Databasement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.10.9

Disable the auto_link_by_email configuration option to prevent linking OIDC identities to existing local users by email alone. For OIDC providers that do not send email_verified claims (such as Entra ID), set OAUTH_OIDC_TRUST_EMAIL_WITHOUT_VERIFIED_CLAIM only after confirming the provider's security guarantees.

Technical details

The OAuthService::findOrCreateLocalUser() method links OIDC identities to local users by email without verifying the email_verified claim. An attacker can register an unverified email at an identity provider and use it to log in as any existing Databasement user. The vulnerability affects the auto_link_by_email feature and is exploitable remotely with network access to the OAuth flow.

Affected products

David-Crty Databasement before 1.10.9

Timeline

2026-11-04: disclosed: Vulnerability published in CVE-2026-121939
2026-11-03: patched: Fix merged (commit b7f4079) requiring email_verified claim before OIDC auto-link by email

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.