Description
Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rabithua | Rote | 1.2.0 – ≤ 2.6.0 | — |
References
- https://github.com/Rabithua/Rote/pull/420 issue-tracking patch
- https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b patch
- https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659 technical-description
- https://vul.yulun.ac.cn/20261104/rote/ third-party-advisory
- VulnCheck Advisory: Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint third-party-advisory