CVE-2026-120999

Overview

Improper authentication in NervesHub's Google sign-in and email confirmation allows an attacker to hijack an account by registering the victim's email. The flaw lets the attacker link the victim’s email to their own account without verification, enabling access when the victim signs in. This affects NervesHub versions 2.3.0 through 2.5.2.

Description

Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account's owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account's email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address's owner signs in with Google or follows the confirmation link, they land in that account. The Google path also creates accounts with registrations closed and never checks Google's email_verified claim, and the API's password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path. This issue affects nerves_hub: from 2.3.0 before 2.5.3.

Impact

The vulnerability compromises confidentiality by allowing attackers to access victim accounts, integrity by enabling unauthorized account modifications, and availability if attackers lock out legitimate users. Defenders must ensure email verification and restrict account linking to verified addresses. The issue is exploitable only when victims use Google sign-in or email confirmation, so risk is limited to those authentication paths.

Remediation

Apply the latest patch (2.5.3 or later) that enforces email verification and requires the account owner to confirm ownership before linking. If patch not available, disable Google sign-in and email confirmation flows, or enforce manual verification of email_verified claim from Google. Additionally, block API password sign-in for unconfirmed accounts and audit existing accounts for unverified email links.

Risk context

Severity high, CVSS v3 8.8. No EPSS data. The flaw is urgent for deployments that rely on Google authentication or email confirmation, as attackers can hijack accounts without further action.

Affected products

• NervesHub
• nerves-hub
• nerves_hub_web
• NervesHubWeb
• NervesHub.Accounts
• NervesHubWeb.SessionController
• NervesHubWeb.API.UserController
• NervesHub API