bbs-go: Authentication bypass via Google One Tap login
Summary
bbs-go up to and including 4.4.6 has an authentication bypass in the /api/login/google_one_tap endpoint. The application does not check the aud (audience) claim of submitted Google ID tokens, so tokens issued to any OAuth client are accepted. An attacker with their own Google OAuth client who obtains a victim's Google-signed ID token can replay it and get an authenticated session as the victim's linked account, without knowing the victim's password.
Affected
- mlogclub bbs-go, versions 0 to 4.4.6 (inclusive)
- Deployments with Google One Tap login enabled are affected
Fixed in
Unknown.
Workaround
- Disable Google One Tap login in the application until a fixed version is available
- Restrict access to the login endpoint at a reverse proxy where feasible
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept available), not automatable
- Technical impact: total
- No confirmed in-the-wild exploitation known
Our recommendation
- Check whether bbs-go is deployed and which version is running
- If version 4.4.6 or earlier is in use, disable Google One Tap login or restrict the endpoint as a temporary measure
- Monitor logins for unusual sessions on accounts linked to Google, and force password resets and session invalidation if misuse is suspected
- Apply the vendor update once available and check the upstream releases page
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- bbs-go jwt.go at v4.4.6 github.com
- bbs-go third_user_service.go at v4.4.6 github.com
- bbs-go releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:51.
Original description (NVD)
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
NVD references (5)
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/pkg/google/jwt.go#L55-L58
- https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/third_user_service.go#L274-L293
- https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover
- https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-account-takeover-via-google-one-tap-login
- https://hackmd.io/@hieuPenguinnn/bbs-go-google-one-tap-id-token-audience-confusion-account-takeover
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.