CVE Alert: CVE-2026-126801 – Rabithua

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.

**Risk verdict:** This is a high-impact account-compromise risk; exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS status were not provided.

**Why this matters:** An attacker could gain control of another user’s application data, disrupt their access and obtain credentials or keys stored in the account. Reused API keys could extend impact into connected services, although that depends on how those keys are scoped and managed.

**Most likely attack path:** A remote attacker needs only a valid low-privilege account; the request requires no user interaction and has no apparent additional preconditions. The vulnerable merge flow appears to trust attacker-supplied account identifiers, with impact contained to the application’s security authority; lateral movement is most plausible through exposed or reused API keys.

**Who is most exposed:** Prioritise internet-accessible deployments that allow OAuth sign-in with GitHub or Apple, especially shared or self-hosted instances containing sensitive notes, attachments or integrations.

Alert on unusual OAuth bind/merge requests and repeated attempts using different account identifiers.

Review account-linking, deletion and authentication logs for unexpected changes.

Check for API-key access from unfamiliar sources after suspicious account merges.

Mitigation and prioritisation

Upgrade promptly to a release containing the fix; confirm the deployed build includes the upstream correction.

If upgrading is delayed, disable or restrict the affected account-merge flow where feasible.

Review recent account links and deletions; revoke potentially exposed API keys and reset affected credentials.

Validate recovery and rollback procedures before making production changes.

Obtain current KEV, SSVC and EPSS status to refine urgency; the available data does not establish whether priority 1 treatment is warranted.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.