CVE-2026-63398 (GCVE-0-2026-63398)
Vulnerability from cvelistv5
Published
2026-10-30 22:44
Modified
2026-11-02 17:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:34.942380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:56:56.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coop",
"vendor": "roostorg",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy\u0027s verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization\u0027s callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:44:43.092Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2"
},
{
"name": "https://github.com/roostorg/coop/pull/783",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/pull/783"
},
{
"name": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071"
},
{
"name": "https://github.com/roostorg/coop/releases/tag/1.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/roostorg/coop/releases/tag/1.0.2"
}
],
"source": {
"advisory": "GHSA-2v93-383c-9fw2",
"discovery": "UNKNOWN"
},
"title": "Coop has SAML cross-tenant authentication bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63398",
"datePublished": "2026-10-30T22:44:43.092Z",
"dateReserved": "2026-07-16T19:20:28.986Z",
"dateUpdated": "2026-11-02T17:56:56.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63398\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-02T17:09:34.942380Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-02T17:09:41.790Z\"}}], \"cna\": {\"title\": \"Coop has SAML cross-tenant authentication bypass\", \"source\": {\"advisory\": \"GHSA-2v93-383c-9fw2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"roostorg\", \"product\": \"coop\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.0.2\"}]}], \"references\": [{\"url\": \"https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2\", \"name\": \"https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/roostorg/coop/pull/783\", \"name\": \"https://github.com/roostorg/coop/pull/783\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071\", \"name\": \"https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/roostorg/coop/releases/tag/1.0.2\", \"name\": \"https://github.com/roostorg/coop/releases/tag/1.0.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy\u0027s verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization\u0027s callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-30T22:44:43.092Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-63398\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-02T17:56:56.369Z\", \"dateReserved\": \"2026-07-16T19:20:28.986Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-30T22:44:43.092Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…