CVE-2026-51584: usememos Auth Bypass Vulnerability

CVE-2026-51584 Overview

CVE-2026-51584 is an authentication vulnerability in usememos version 0.27.1, an open-source note-taking application. The flaw resides in the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go. The implementation matches Single Sign-On (SSO) identities using an attacker-controllable identifier without binding to the Identity Provider's (IdP) stable subject claim. A remote unauthenticated attacker can exploit this weakness to take over arbitrary accounts. The issue is categorized under [CWE-287: Improper Authentication].

Critical Impact
A remote, unauthenticated attacker can achieve full account takeover by supplying a controllable identifier during SSO sign-in, resulting in complete compromise of confidentiality, integrity, and availability for targeted accounts.

Affected Products

usememos/memos version 0.27.1
Deployments relying on the SSO sign-in flow of the affected release
Self-hosted memos instances exposing auth_service.go SSO endpoints

Discovery Timeline

2026-08-11 - CVE-2026-51584 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-51584

Vulnerability Analysis

The vulnerability exists in the SSO authentication path of memos. During sign-in, the server processes credentials supplied under the ssoCredentials branch and looks up the local user account based on an identifier returned during the SSO exchange. Because the lookup relies on an attacker-controllable field rather than the IdP's cryptographically stable subject claim, an attacker can present arbitrary identity information to impersonate any existing user. This bypasses the intended trust boundary between the memos application and the external IdP.

Root Cause

The root cause is improper authentication logic in the ssoCredentials handler within server/router/api/v1/auth_service.go. The code matches SSO identities using a mutable identifier such as an email or username rather than the immutable sub claim issued by the IdP. Because the matching key is not bound to the IdP's stable subject, any attacker capable of controlling that field during the SSO exchange can be linked to an existing local account.

Attack Vector

Exploitation occurs over the network without prior authentication or user interaction. An attacker initiates the SSO sign-in flow against a vulnerable memos instance and supplies an identifier matching the victim account. The server accepts the mapping and issues a session bound to the victim's account. Full technical details are documented in the GitHub Gist proof of concept and the usememos/memos project repository.

Detection Methods for CVE-2026-51584

Indicators of Compromise

Successful SSO sign-in events for accounts that have never previously authenticated through the configured IdP.
Session creation events where the SSO identifier used for lookup differs from the IdP subject claim recorded in upstream logs.
Login activity from unexpected geographies or IP ranges immediately following SSO configuration changes.

Detection Strategies

Correlate memos application logs against IdP-side authentication logs to detect mismatches between the local account resolved and the IdP sub claim.
Alert on repeated ssoCredentials sign-in attempts targeting privileged accounts, especially administrators.
Review audit logs for accounts whose linked SSO identifier was modified without a corresponding administrative action.

Monitoring Recommendations

Enable verbose logging on the SignIn handler and forward events to a centralized log platform for correlation.
Monitor for anomalous session issuance patterns, including bursts of successful SSO logins for distinct users from a single source.
Track changes to user records and SSO identity mappings in the memos database and alert on unexpected modifications.

How to Mitigate CVE-2026-51584

Immediate Actions Required

Disable the SSO sign-in flow in memos 0.27.1 until a patched release is deployed.
Restrict network exposure of the memos instance to trusted networks or place it behind an authenticating reverse proxy.
Rotate active sessions and force re-authentication for all accounts, particularly administrative users.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Monitor the usememos/memos project repository for security releases addressing the ssoCredentials handler in server/router/api/v1/auth_service.go and upgrade as soon as a corrected version is published.

Workarounds

Configure the IdP to require additional verification steps such as multi-factor authentication before issuing tokens accepted by memos.
Temporarily switch to local password authentication and remove SSO provider configurations from the memos settings.
Apply application-layer filtering at a reverse proxy to reject SSO callbacks that do not include the expected IdP subject claim.

bash

# Example: disable SSO by removing identity provider configuration via memos API
# Replace HOST, TOKEN, and IDP_ID with values appropriate to your environment
curl -X DELETE "https://HOST/api/v1/identityProviders/IDP_ID" \
  -H "Authorization: Bearer TOKEN"