Rote's OAuth Surface Requires Identity Evidence That a Product Count Cannot Supply
Rote's OAuth Surface Requires Identity Evidence That a Product Count Cannot Supply Rote is a small self-hosted identity and account-linking application. Its public footprint is narrow compared with major platforms, but
Rote's OAuth Surface Requires Identity Evidence That a Product Count Cannot Supply
Rote is a small self-hosted identity and account-linking application. Its public footprint is narrow compared with major platforms, but CVE-2026-126801 concerns a privileged OAuth bind/merge path that a product count cannot reveal.
ZoomEye queries used sub_type=all, page 1 and page size 1 on 2026-11-13 between 08:49 and 08:50 Asia/Shanghai.
| Query | Matching assets |
|---|---|
app="Rote" |
8 |
title="Rote" |
393 |
The app result is a compact candidate pool. The title result is larger and may include pages that use the word in another context. Neither result identifies a vulnerable version or an enabled account-linking feature.
The vulnerable operation is internal state
CVE-2026-126801 affects Rote 1.2.0 through 2.6.0. The public description says an authenticated user can merge any OAuth-bound account through the bind/merge endpoint by submitting a public existingUserId and a GitHub or Apple identifier.
An external observer cannot see the target account's OAuth link, the application's local user ID or the authorization decision. Those are internal records. The patch commit changes the code path, but the deployed application must also review whether prior merges are visible in its audit history.
Inventory the identity plane
Search internal records for Rote hosts, OAuth client IDs, callback URLs and account-linking settings. Confirm the deployed build contains the patch commit 865d69fceb9c1f1a0d30923fae7cef072a38b22b.
Map the accounts that can use GitHub or Apple login and the data that follows a merge. Include sessions, API tokens, shared resources and administrator roles.
The ZoomEye app matches can help find owner-managed deployments. A title match should be reviewed manually and should not be contacted with an authentication attempt.
Review past account changes
Look for merge requests, provider-link changes, ownership transfers and sessions created soon after a merge. Compare the authenticated source account with the target user ID and provider identifier.
The advisory does not provide a universal log signature. Analysts must first learn how the deployment records OAuth operations. Preserve the provider subject IDs and application event IDs while limiting unnecessary personal data.
Patch and verify
Deploy the patched build and test with two controlled accounts. Confirm that the endpoint rejects a merge unless the caller proves ownership of both the local account and the provider identity.
If a suspicious merge occurred, require reauthentication and review what the merged identity could access. Rotate sessions and any tokens created during the affected period.
Measurement boundary
The 8 app matches are useful for a focused external review; the 393 title matches are discovery noise unless each candidate is matched to an owner. CVE-2026-126801 is an object-authorization issue, so the decisive evidence is the account state and the merge audit trail.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.