CVE-2026-111639 is a high severity (CVSS 8.1) authentication bypass in bbs-go through 4.4.6. The Google One Tap login endpoint never checks the audience claim of the ID token, so a token issued to any OAuth client can log someone in as the victim. The record names no fixed version.
What's affected
bbs-go 4.4.6 and earlier, according to the record and VulnCheck. The affected route is the Google One Tap login API. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
Only sites that have enabled Google sign in are in the blast radius, but those sites should assume that any user who linked a Google account can be impersonated.
Scoring note: the record's 8.1 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.6 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check the version of bbs-go you deployed. Then check whether Google One Tap login is configured. If it is not enabled, the route is not part of your login flow, though you should still confirm the endpoint is not reachable.
Look for unusual sessions on Google-linked accounts, such as new logins from unfamiliar networks right before profile or content changes. Compare login times against what the account owner reports.
What to do now
- Find every bbs-go deployment and its version.
- If you can, disable Google One Tap login until a fix is confirmed.
- Invalidate active sessions for Google-linked accounts and review moderator and admin accounts first.
- If you maintain a fork, add a check that the token audience equals your own client ID.
- Watch the project's releases and upgrade once a fix is published.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-287, improper authentication. A Google ID token is a signed statement that says who the user is and which application it was issued for. If the server verifies the signature but ignores the audience, a token minted for a different application is accepted as proof of identity here.
That is why the record describes attackers using their own Google OAuth client. They capture a token for a victim who signs in to the attacker's app and replay it against the vulnerable site. The CVSS vector marks user interaction as required, because the victim has to sign in somewhere the attacker controls. It is not in CISA KEV.
Quick check
What is the audience claim?
It names the application a token was issued for. A server must reject tokens whose audience is not its own client ID.
Does this need the victim's password?
No. The record says a replayed Google-signed token is enough.
Sources
Last reviewed: 18 October 2026.
