CVE-2026-68551

Description

Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 8.3CVSS 4.0, Highfrom the CNA (GitHub_M)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-287
• CWE-345

References

• https://github.com/teelur/budget-board/security/advisories/GHSA-576g-r8m3-q9vpx_refsource_CONFIRM
• https://github.com/teelur/budget-board/pull/956x_refsource_MISC
• https://github.com/teelur/budget-board/commit/8c050368e6a01c72f41ab39be913fbf95f1cb253x_refsource_MISC
• https://github.com/teelur/budget-board/releases/tag/v3.6.2x_refsource_MISC