high severity · published 2026-08-11
Anyone who can obtain a token accepted by a configured trusted key can authenticate as any existing user and take full control of that account. This works because the service trusts the token's email claim without checking it is verified or checking the key's role limits.
Fixed in: 2.31.5
CVE: CVE-2026-72772
Source: NVD
You are affected if the installed version is older than 2.31.5. Check the version you have and update to 2.31.5 or later. The fixed version is verified against a vendor or advisory source.
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 145 and your operating system.