Is CVE-2026-41574 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41574 being exploited in the wild.

How severe is CVE-2026-41574?

Critical severity, with a CVSS score of 9.8, published 8 May 2026.

Which products and versions are affected?

github.com/nhost/nhost (Go) < 0.0.0-20260417112436-ec8dab3f2cf4, SEMVER:introduced=0,fixed=0.0.0-20260417112436-ec8dab3f2cf4; Nhost\ < 0.0.0-20260417112436-ec8dab3f2cf4.

Is there a fix for CVE-2026-41574?

Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41574 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-41574?

Check whether you run github.com/nhost/nhost (Go) or Nhost\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41574: Nhost Auth account takeover via OAuth email verification bypass

Q: Is there a fix for CVE-2026-41574?

Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41574 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-41574?

Check whether you run github.com/nhost/nhost (Go) or Nhost\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41574 · Severity: critical · CVSS 9.8 · Published 2026-05-08

Nhost, an open-source backend platform, is vulnerable to a flaw that allows attackers to take over user accounts. By using third-party login services like Discord or Bitbucket with an unverified email address that matches a victim's account, an attacker can trick the system into granting them full access to that victim's data and sessions. This could lead to unauthorized access to sensitive information, data theft, or permanent lockout of legitimate users.

Technologies: github.com/nhost/nhost (Go), Nhost\. Vendors: Go, Nhost.

Quick answers

Is CVE-2026-41574 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41574 being exploited in the wild.
How severe is CVE-2026-41574?: Critical severity, with a CVSS score of 9.8, published 8 May 2026.
Which products and versions are affected?: github.com/nhost/nhost (Go) < 0.0.0-20260417112436-ec8dab3f2cf4, SEMVER:introduced=0,fixed=0.0.0-20260417112436-ec8dab3f2cf4; Nhost\ < 0.0.0-20260417112436-ec8dab3f2cf4.
Is there a fix for CVE-2026-41574?: Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41574 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-41574?: Check whether you run github.com/nhost/nhost (Go) or Nhost\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nhost/nhost (Go): upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 or later
```
go get github.com/nhost/nhost@v0.0.0-20260417112436-ec8dab3f2cf4
```

Technical details

An authentication bypass exists in Nhost's OAuth implementation where the system automatically merges identities based on email addresses without verifying that the email has been confirmed by the provider. The root cause is twofold: the central controller (`providerFlowSignIn`) fails to check the `EmailVerified` flag, and several provider adapters (Discord, Bitbucket, AzureAD, EntraID) incorrectly populate this flag by either ignoring provider-supplied verification status or falling back to unverified fields like UPN. An attacker can register an account with a target's email on a vulnerable provider, leave it unverified, and then use that provider to sign into Nhost, gaining a full authenticated session as the victim. A patch is available in version 0.0.0-20260417112436-ec8dab3f2cf4.

Affected products

nhost nhost < 0.0.0-20260417112436-ec8dab3f2cf4

Identifiers

CVE-2026-41574
GHSA-6g38-8j4p-j3pr
GO-2026-5176

Timeline

2026-04-17: patched: Fixed in commit ec8dab3f2cf4
2026-04-17: advisory
2026-04-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.