CVE-2026-10130 – QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts

CVE ID :CVE-2026-10130

Published : July 18, 2026, 11:17 p.m. | 23 minutes ago

Description :QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim’s identity without requiring any prior credentials or user interaction.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…