CVE-2026-120999
Received Received - Intake

Improper Authentication in NervesHub Web

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: EEF

Description
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account's owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account's email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address's owner signs in with Google or follows the confirmation link, they land in that account. The Google path also creates accounts with registrations closed and never checks Google's email_verified claim, and the API's password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path. This issue affects nerves_hub: from 2.3.0 before 2.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120999
EUVD
EUVD-2026-120868

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nerves-hub nerves_hub_web From 2.3.0 (inc) to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authentication issue in NervesHub's Google sign-in and email confirmation processes. An attacker can register another person's email address and gain access to their account when the victim signs in via Google or clicks an email confirmation link. The system fails to verify email ownership properly, allowing the attacker to link the victim's email to their own account. When the victim signs in, they are logged into the attacker's account, granting access to organizations and resources.

Detection Guidance

Check NervesHub logs for suspicious account creation or login events, particularly for accounts linked to Google sign-in or email confirmation links. Look for multiple accounts using the same email address or unexpected session tokens.

Impact Analysis

If you are a user of NervesHub versions 2.3.0 to 2.5.2, an attacker could gain access to your account by registering your email address first. When you sign in via Google or click a confirmation link, you may be logged into the attacker's account instead. This could allow the attacker to access your organizations, resources, and perform actions on your behalf. The attacker may retain access even if you reset your password.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If an attacker gains access to an account, they may exfiltrate or manipulate personal or health information, resulting in non-compliance with data protection regulations. Organizations using NervesHub must ensure proper authentication controls are in place to meet compliance standards.

Mitigation Strategies
  • Upgrade NervesHub to version 2.5.3 or later to apply the security patches.
  • Disable Google sign-in as a temporary workaround if upgrading is not immediately possible.
  • Review all user accounts for unauthorized access or email changes, and reset passwords for affected accounts.
  • Ensure email confirmation links no longer automatically sign users in; require separate login after confirmation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...