Queryweaver
Monthly
Authentication bypass in FalkorDB QueryWeaver lets unauthenticated attackers hijack any existing account by submitting a signup request containing the victim's email address, whereupon the server issues a valid session token bound to the victim's identity. No credentials, prior access, or user interaction are required, making this a pre-auth account takeover. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available.
Authentication bypass in FalkorDB QueryWeaver lets unauthenticated attackers hijack any existing account by submitting a signup request containing the victim's email address, whereupon the server issues a valid session token bound to the victim's identity. No credentials, prior access, or user interaction are required, making this a pre-auth account takeover. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available.