EUVD-2026-62201Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable with no privileges; victim SSO login required (UI:R); full account compromise but no scope change beyond the victim's own account.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.
AnalysisAI
Pre-account takeover in 4gaBoards before 3.3.8 allows a remote unauthenticated attacker to seize a victim's account before the victim ever logs in, by exploiting the SSO identity-linking logic. An attacker registers an unverified local account using the victim's email address; when the victim subsequently logs in via Google, GitHub, Microsoft, or OIDC SSO, the server locates the attacker's pre-registered account by email and links the verified SSO identity to it without confirming local account ownership, granting the attacker persistent password access to the now-SSO-linked account and all associated projects and data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following configuration flags to be simultaneously enabled on the target instance: registrationEnabled=true, localRegistrationEnabled=true, and ssoRegistrationEnabled=true. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the threat profile: the attack is network-reachable, requires no privileges, and results in full account compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to 4gaBoards 3.3.8 immediately; this is the vendor-confirmed fix as documented in the GitHub release at https://github.com/RARgames/4gaBoards/releases/tag/v3.3.8 and security advisory GHSA-f3p6-chc6-pc77. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all 4gaBoards deployments and current versions in your environment, then review SSO login logs for suspicious authentication patterns or newly created accounts that logged in via SSO, specifically looking for discrepancies between account creation date and first login date. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today