CVE-2026-10130 - QueryWeaver Authentication Bypass Vulnerability
CVE-2026-10130 - QueryWeaver Authentication Bypass Vulnerability
Date Published: July 18, 2026
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim’s identity without requiring any prior credentials or user interaction. 🚨
Remotely Exploit: Yes!
The published date for CVE-2026-10130 is July 18, 2026, at 11:17 p.m. It was last modified on the same date and time. This vulnerability is associated with the following Common Weakness Enumeration (CWE): CWE-863: Incorrect Authorization. While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities.
Affected Products
| Currently, no affected products have been recorded. Total Affected Vendor: 0 | Products: 0. |
Recommendations
To address this issue, it is crucial to fix the authentication bypass by verifying existing accounts before creating new session tokens. Specific recommendations include:
- Validate if the email exists before creating a new token.
- Ensure session tokens are only issued to authenticated users.
- Apply vendor patches or updates when available.
Understanding the vulnerability history details can be useful for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics.
For more information, you can read the complete article here: Read full article 🚀