Executive brief
BookStack is a popular open-source documentation and knowledge management platform. A flaw in its social login feature allows attackers to sign in as arbitrary users without valid credentials by authenticating through a different social provider linked to the same account. This could grant unauthorized access to sensitive documents, settings, and user data across all BookStack instances using multiple social login methods.
Technical details
BookStack contains an authentication bypass vulnerability in the SocialAuthService::handleLoginCallback method, where user account lookups by social provider are not properly scoped to the specific authentication driver. An attacker can authenticate at one enabled social provider using a user ID matching an account linked to a different social provider, bypassing all credential verification. The vulnerable query ignores the driver column when retrieving linked social account records, allowing cross-provider account confusion attacks. The vulnerability affects BookStack before version 26.05.5 and is network-accessible without authentication or user interaction required. The fix scopes social account queries to the specific social login system (driver) to prevent mismatched account lookups.
Affected products
- BookStack BookStack before 26.05.5
Timeline
- 2026-09-15: disclosed
- 2026-09-14: patched: Fix released in version 26.05.5