CVE-2026-68551
Received Received - Intake

Improper OIDC Authentication in Budget Board

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-68551
EUVD
EUVD-2026-125723

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
budget_board budget_board to 3.6.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Budget Board before version 3.6.2 has an OIDC login flaw where it signs into local accounts by matching email addresses from identity providers without verifying the email_verified claim. If an OIDC provider allows unverified email registration, an attacker can register with a victim's email and gain access to their Budget Board account and linked bank data.

Impact Analysis

An attacker could gain unauthorized access to your Budget Board account, view sensitive financial data, and potentially manipulate or steal linked bank information if they register an unverified email matching yours on a misconfigured OIDC provider.

Compliance Impact

This vulnerability could lead to unauthorized access to personal financial data, potentially violating GDPR's data protection principles or other regulations requiring strict access controls and verified user identities.

Mitigation Strategies

Update Budget Board to version 3.6.2 or later to patch the vulnerability. Review OIDC provider configurations to ensure email verification is enforced before allowing email-based logins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68551. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...