{
  "cveId": "CVE-2026-121939",
  "product": "Databasement",
  "originalPublication": "2026-11-04T12:31:18.485Z",
  "cnaPublicDisclosure": "2026-11-03T23:19:08Z",
  "researchDate": "2026-11-04",
  "ratings": [
    {
      "source": "VulnCheck",
      "version": "4.0",
      "score": 9.2
    },
    {
      "source": "VulnCheck",
      "version": "3.1",
      "score": 8.1
    }
  ],
  "vendorSeverity": "High",
  "affected": "before1.10.9",
  "fixed": "1.10.9",
  "sources": [
    {
      "version": "1.10.8",
      "revision": "4097efc212bab01b96c3e14c530fa6f52627d87a",
      "gitBlob": "dcb49d845c7fad07085f837cda383eb855d2780d",
      "path": "app/Services/OAuthService.php",
      "sha256": "00c00d056de6ff9e5c06efa5213e15598e4458afdee7a1bec232a3f8cb2ef262",
      "verified": "Pinned public official GitHub download; Git blob hash matched source metadata."
    },
    {
      "version": "1.10.9",
      "revision": "7300ba824c97a9c5f411a8cf3f68e2a4561362bf",
      "gitBlob": "008622c077e0062b7a95bdc0a1cb11e7b42e6e44",
      "path": "app/Services/OAuthService.php",
      "sha256": "3564af5e283df0fe92bf6497849bdb22337571c7fe52f6d1728dd6dccd938730",
      "verified": "Pinned public official GitHub download; Git blob hash matched source metadata."
    }
  ],
  "componentChecks": {
    "runtime": "PHP8.5.4",
    "caseExecutions": 16,
    "allVersionExpectationsMatched": true,
    "oldVersionSecurityPassed": false,
    "results": [
      {
        "version": "1.10.8",
        "cases": [
          {
            "case": "verified",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "verified_string",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "unverified",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "missing_claim",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "trusted_missing",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "unverified_despite_trust",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          },
          {
            "case": "linking_disabled",
            "expectedForVersion": "refused",
            "observed": "refused",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "other_provider_control",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "cleared",
            "expectedPassword": "cleared",
            "expectationMatched": true
          }
        ],
        "allVersionExpectationsMatched": true,
        "scope": "Actual private OAuthService component with synthetic Socialite/config and in-memory own-account model. No HTTP, identity provider, account authentication, token, database or exploit payload."
      },
      {
        "version": "1.10.9",
        "cases": [
          {
            "case": "verified",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "verified_string",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "unverified",
            "expectedForVersion": "refused",
            "observed": "refused",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "missing_claim",
            "expectedForVersion": "refused",
            "observed": "refused",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "trusted_missing",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "unverified_despite_trust",
            "expectedForVersion": "refused",
            "observed": "refused",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "linking_disabled",
            "expectedForVersion": "refused",
            "observed": "refused",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          },
          {
            "case": "other_provider_control",
            "expectedForVersion": "linked",
            "observed": "linked",
            "password": "preserved",
            "expectedPassword": "preserved",
            "expectationMatched": true
          }
        ],
        "allVersionExpectationsMatched": true,
        "scope": "Actual private OAuthService component with synthetic Socialite/config and in-memory own-account model. No HTTP, identity provider, account authentication, token, database or exploit payload."
      }
    ],
    "memoryMiB": 64,
    "wallSecondsPerVersion": 5,
    "limits": [
      "No full Laravel/vendor feature suite",
      "No real IdP/token/signature/browser authentication",
      "No session revocation/returning-identity path",
      "No real role mapping/database transaction",
      "No backup/restore deployment validation"
    ]
  },
  "isolation": {
    "sessionId": "sbx_Azld8hDuhNiRgEz1267QPUAlMwzN",
    "vcpus": 2,
    "memoryMiB": 4096,
    "timeoutMs": 2700000,
    "persistent": false,
    "exposedPorts": [],
    "hostMounts": [],
    "privateNetworks": false,
    "ipv6DisabledReadback": true,
    "prepHosts": [
      "registry.npmjs.org",
      "raw.githubusercontent.com",
      "archive.ubuntu.com",
      "security.ubuntu.com"
    ],
    "deniedCIDRs": [
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "127.0.0.0/8",
      "100.64.0.0/10",
      "0.0.0.0/8"
    ],
    "liveDenyAllSetAndReadBackBeforeTests": true,
    "cloudCredentialsInside": false
  },
  "contentValidation": {
    "scope": "Actual repository article/listing/metadata/OG routes and CSS with minimal isolated bootstrap and related-reading fixture; not full application build",
    "og": {
      "width": 1200,
      "height": 630,
      "brand": "Existing public/logo-wide.svg; proportions preserved",
      "font": "Existing src/fonts/Satoshi.ttf"
    },
    "results": {
      "formatting": "passed",
      "scopedNextBuildAndTypes": "passed",
      "renderChecks": 28,
      "passed": true,
      "checkedAt": "2026-11-04T23:31:01.949Z",
      "fullApplicationBuild": "not_run"
    }
  }
}