Vulnerability Description
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/FalkorDB/QueryWeaver
- https://github.com/FalkorDB/QueryWeaver/commit/e6a49f508191d0f1bdad0f146da43819e
- https://www.vulncheck.com/advisories/queryweaver-authentication-bypass-via-email
FAQ
What is CVE-2026-10130?
CVE-2026-10130 is a vulnerability with a CVSS score of 8.2 (HIGH). QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victi...
How severe is CVE-2026-10130?
CVE-2026-10130 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-10130?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.