CVE-2026-66028

This vulnerability stems from a missing database-level uniqueness constraint on the email field—the application treats email as the unique account identifier, but never enforced this at the schema or application layer. When multiple records share the same email, the authentication flow encounters undefined behavior: the system has no deterministic rule for which credential to validate, creating unpredictable login outcomes that bypass normal security assumptions. The exploitation pathway matters more than the CVSS suggests. An administrator must first create the duplicate state—that's the high-privilege prerequisite. But once duplicate records exist, the password reset flow becomes the attack vector: a legitimate user requesting a password reset may have the reset token generated against the wrong account record, sending a valid token to the attacker's enrolled email address. This converts the flaw into horizontal privilege escalation requiring no further admin access. The attacker intercepts the reset token, sets a new password on the victim's account, and gains full control. Beyond direct account takeover, this flaw contaminates the identity graph that downstream systems rely on. Audit logs attribute actions to the wrong principal, billing systems charge the wrong accounts, and compliance reporting becomes unreliable. The application continues functioning for single-record queries, so there's no application-layer error or alert—this silent failure persists until someone explicitly audits the database for duplicate identity records. For detection and remediation: audit your database for tables where email should be unique but lacks a uniqueness constraint or unique index. Implement application-layer validation that rejects duplicate email registration before insert. Add monitoring for authentication queries that return multiple identity records. The definitive fix is enforcing uniqueness at the schema level—this prevents the vulnerable state from existing in the first place. The 2026 CVE ID date suggests this may be a forward-dated coordinated disclosure. Treat it as actionable: if you're running the affected product, verify whether your version includes the patch or whether duplicate email records already exist in your production data.

Reviewed through automated stages and approved by a human before publication.