# CVE-2026-68551: Budget Board's OIDC login links to an existing local account by email alone, with no email_verified check, enabling account takeover of pre-existing users

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- teelur / budget-board: < 3.6.2 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 4.0: 8.3 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-287, CWE-345

## Exploit evidence

- exploit: https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp (ADP: CISA-ADP)

## References

- https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/teelur/budget-board/pull/956 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/teelur/budget-board/commit/8c050368e6a01c72f41ab39be913fbf95f1cb253 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/teelur/budget-board/releases/tag/v3.6.2 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vp (ADP: CISA-ADP; exploit)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-68551; retrieved 2026-11-13; source updated 2026-11-13

Revision: be339f7ca45e654d5ee17ac47be64b746881f9d6e6779446aeea2103a3fd7bee

Canonical: https://y2.dev/cve/CVE-2026-68551

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.