CVE-2026-10130 Overview
CVE-2026-10130 is an authentication bypass vulnerability in QueryWeaver, an open source project maintained by FalkorDB. The signup endpoint issues a valid authenticated session token for any email address submitted, including those belonging to existing accounts. An unauthenticated attacker who knows a victim's email address can obtain a session token that impersonates that account. No credentials, multi-factor challenge, or user interaction are required. The flaw is classified under CWE-863: Incorrect Authorization.
Critical Impact
Attackers can hijack existing QueryWeaver accounts by submitting a signup request with the target's email, receiving a valid session token that grants full access to the victim's identity and data.
Affected Products
- QueryWeaver (FalkorDB) — versions prior to the fix in commit e6a49f5
- Deployments exposing the signup route to untrusted networks
- Any instance built from the QueryWeaver repository before the remediation commit
Discovery Timeline
- 2026-07-18 - CVE-2026-10130 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-10130
Vulnerability Analysis
QueryWeaver's signup route mishandles the account creation flow when the submitted email matches an existing Identity. Instead of rejecting the request or requiring credential verification, the server unconditionally creates a new session token and links it to the existing Identity node via a Cypher MERGE operation. The response returns that token to the requester, granting authenticated access to the victim's account.
The root defect is an authorization check performed after state-changing operations rather than before. Because the check-then-act ordering is inverted, the code path that should reject duplicate signups instead completes authentication for the attacker.
Root Cause
The signup handler executes a Cypher MERGE against the Identity graph using the submitted email as the match key. MERGE matches the existing Identity node when one is present, and the handler then creates and links a new token to it. Only after the token is issued does the code evaluate whether the email already exists, at which point the attacker has already received a valid session credential in the HTTP response.
Attack Vector
Exploitation is performed remotely over the network by sending a single crafted signup HTTP request containing the victim's email address. No authentication, prior session, or user interaction is required. The server responds with a session token bound to the victim's Identity, which the attacker then uses in subsequent authenticated API calls. Because the attack relies on standard signup traffic, it produces no failed authentication events and blends into normal onboarding activity.
Detection Methods for CVE-2026-10130
Indicators of Compromise
- Signup requests submitted for email addresses that already correspond to registered QueryWeaver accounts.
- Session tokens issued to client IP addresses that differ from the historical login sources of the associated account.
- Signup responses returning 200 OK with a session token payload when the target email already exists in the Identity graph.
- Cypher audit logs showing MERGE on Identity nodes immediately followed by token linkage from unauthenticated contexts.
Detection Strategies
- Correlate signup events with existing user records and alert when the submitted email matches an established Identity.
- Baseline signup-to-login sequences per account and flag deviations where a signup precedes activity from a known active user.
- Inspect application logs for token issuance stemming from the signup route rather than the login route.
Monitoring Recommendations
- Enable verbose logging on the QueryWeaver authentication service, including request source IP, submitted email, and token issuance events.
- Forward authentication and signup telemetry to a centralized SIEM or data lake for cross-correlation with identity activity.
- Monitor FalkorDB query logs for unexpected MERGE patterns against Identity nodes originating from unauthenticated endpoints.
How to Mitigate CVE-2026-10130
Immediate Actions Required
- Upgrade QueryWeaver to a build that includes commit e6a49f5 or later.
- Invalidate all active session tokens and force password or credential resets across existing accounts.
- Review authentication and signup logs for evidence of token issuance to attacker-controlled sources.
- Restrict network exposure of the signup endpoint until the patch is applied.
Patch Information
FalkorDB has published a fix in the QueryWeaver repository at commit e6a49f5. The patch reorders the signup flow to check for an existing Identity before issuing or linking a session token. Additional context is available in the VulnCheck Authentication Bypass Advisory and the QueryWeaver repository.
Workarounds
- Place the signup route behind an authenticated reverse proxy or allowlist trusted networks until the patch is deployed.
- Disable self-service signup and provision accounts through an administrative workflow.
- Add a pre-check at an application gateway to reject signup requests whose email matches an existing Identity.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
