Executive brief
Memos is an open-source note-taking application that supports single sign-on (SSO) for user authentication. A critical flaw allows attackers to take over any user account—including admin accounts—by manipulating their identity provider username or email to match a victim's Memos username, without requiring access to the victim's account or credentials.
Technical details
The vulnerability is an authentication bypass (CWE-287 / CWE-284) in the SSO sign-in handler (server/router/api/v1/auth_service.go). When SSO is enabled, the application resolves local user accounts using only the identity provider's identifier (e.g., username, email, preferred_username) as a lookup key, without binding to the IdP's stable subject claim (sub). An unauthenticated remote attacker can exploit this by setting their identifier on any configured public IdP to match a victim's Memos username, completing the OAuth2 authorization flow, and receiving a valid session token for the victim's account. The attack requires knowledge of a target username and a configured public IdP, but no prior access. The vulnerability was patched in v0.28.0 by introducing a user_identity table that binds external identities to local users via stable subject claims.
Affected products
- usememos Memos ≤ v0.27.1
Timeline
- 2026-08-11: disclosed: Advisory published on NVD
- 2026-04-23: patched: Fixed in v0.28.0 via commit d688914b