Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-10130: QueryWeaver: Attackers can hijack existing accounts via email
CVE-2026-10130
CVE-2026-10130
Summary
An attacker can steal an existing QueryWeaver account by knowing the victim's email address. This can happen because QueryWeaver does not properly check if an email is already linked to an account before creating a new session token. To protect your account, ensure you use strong, unique passwords and monitor your account activity for any suspicious login attempts.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| falkordb | queryweaver | <= 0.2.0 |
Original title
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known vi...
Original description
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.
mitre CVSS3.1
8.2
Vulnerability type
CWE-863
Incorrect Authorization
Published: 18 Jul 2026 · Updated: 19 Jul 2026 · First seen: 18 Jul 2026