bbs-go Through 4.4.6 Vulnerable to Google One Tap Account Takeover (CVE-2026-111639)

bbs-go through version 4.4.6 has an authentication bypass in its Google One Tap login that lets attackers take over Google-linked accounts, tracked as CVE-2026-111639.

The /api/login/google_one_tap endpoint never checks the token audience. An attacker who runs their own Google OAuth client can capture a victim's Google-signed ID token and replay it to bbs-go, because the aud claim is not validated. That yields an authenticated session as the victim's Google-linked account, VulnCheck says.

VulnCheck is the CNA. It rates the issue 8.1 under CVSS 3.1 and 8.6 under CVSS 4.0. NVD has not scored the CVE. The finder is credited as hieuPenguinnn.

Affected builds are through 4.4.6. Operators should upgrade beyond 4.4.6 and ensure Google ID-token validation requires the application's own client ID as the audience.