CVE-2026-61228: Cross-connection account takeover via dynamic_oidc namespace conflict

Vulnerability Summary: Namespace Conflict Leading to Cross-Connection Account Takeover Vulnerability Overview Vulnerability Name: collapses all IdP connections into a single identity namespace, enabling cross-connection account takeover Severity: High (CVSS v3.1 score 7.4) CVE ID: CVE-2026-61228 CWE: CWE-287, CWE-390 Reporters: manus-user, jensjyn, manus-ai Affected Scope Affected Versions: Fixed Version: Impact Scenarios: - Attacker-driven: An attacker operates an IdP for a specific connection (e.g., BYO-IdP deployment) such that its conflicts with the victim’s , causing session tokens to be incorrectly issued to the victim. - Accidental: Sequential overlap in the ID spaces of two IdPs causes distinct users to be misidentified as the same user. Mitigating Factors: Confirmation flows can prevent unconfirmed victims from being taken over; Ash’s multi-tenant isolation (single connection/tenant) avoids this issue. Remediation Core Fix: The runtime is threaded from the populated into the action’s connection queries and query context, ensuring that , , and prefer extracting the connection ID from the context and namespacing the field. Notes: - Namespacing changes the identity lookup keys; legacy data rows will be orphaned ( no longer matches). - Merged accounts cannot be recovered via collision records in the database; affected accounts must be identified by exporting values per connection and computing their intersection. PoC / Exploitation Code The page does not contain a standalone PoC code block, but describes the exploitation path: An attacker manipulates an IdP for a connection so that its conflicts with the victim’s . On each email confirmation, issues a session token based on the attacker’s IdP namespace for the victim. In the accidental scenario, sequentially overlapping values cause distinct users to be misidentified as the same user.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-61228: Cross-connection account takeover via dynamic_oidc namespace conflict

More from this source