CVE-2026-89022: BookStack Social Login Auth Bypass

CVE-2026-89022 Overview

CVE-2026-89022 is an authentication bypass vulnerability in BookStack versions prior to 26.05.5. The flaw resides in the social login implementation, where the SocialAuthService::handleLoginCallback query fails to filter by the driver column when retrieving linked social account records. Unauthenticated attackers can authenticate through one enabled social provider using a driver_id that matches an account linked to a different social provider. This provider confusion allows an attacker to sign in as any user with a linked social account, bypassing credential verification. The weakness maps to CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated attackers can impersonate arbitrary BookStack users, including administrators, when multiple social login providers share overlapping user identifier namespaces.

Affected Products

BookStack versions prior to 26.05.5
Instances with two or more social login providers enabled
Deployments where social login accounts are linked to privileged users

Discovery Timeline

2026-09-15 - CVE-2026-89022 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89022

Vulnerability Analysis

BookStack supports authentication through multiple external social providers. When a user completes an OAuth flow, BookStack stores the returned provider user identifier as a driver_id and links it to a local account. The SocialAuthService::handleLoginCallback function performs a lookup to match the returned driver_id against linked accounts and issues a session for the matched user.

The lookup query omits a filter on the driver column. As a result, any driver_id value returned by any enabled provider matches any linked account with the same identifier value, regardless of which provider issued it. Attackers who control an account at any enabled provider can influence the driver_id returned by that provider and select a value that collides with a victim's linked identifier at a different provider.

Root Cause

The root cause is missing tenancy scoping in the linked-account lookup. Provider identifier namespaces are only unique within a single provider, not across providers. Treating driver_id as globally unique conflates trust boundaries between distinct identity providers and eliminates the binding between the credential verifier and the account record.

Attack Vector

Exploitation requires two or more social providers enabled on the target BookStack instance and knowledge of a victim's driver_id at one of the linked providers. The attacker authenticates at a second enabled provider using an account whose provider-issued identifier matches the victim's linked identifier. BookStack accepts the callback, retrieves the victim's account by identifier alone, and issues an authenticated session for the victim.

No verified proof-of-concept code is publicly available. See the VulnCheck Advisory: Authentication Bypass for additional technical detail.

Detection Methods for CVE-2026-89022

Indicators of Compromise

Successful social login callbacks where the authenticating provider differs from the provider originally linked to the user account.
Session establishment for privileged accounts immediately following an OAuth callback from a provider not previously used by that account.
Unexpected changes to linked social identities in the BookStack social_accounts table.

Detection Strategies

Review BookStack authentication logs for handleLoginCallback events and correlate the callback driver value against the historical provider used by the account.
Alert on any successful login where a user's session provider does not match any previously observed provider for that account.
Baseline social login activity per user and flag first-time provider use for administrator accounts.

Monitoring Recommendations

Forward BookStack web server and application logs to a centralized logging platform for retention and correlation.
Monitor OAuth callback endpoints for high volumes of failed and successful callbacks originating from a single client.
Track administrative actions performed within minutes of a social login event to detect post-authentication abuse.

How to Mitigate CVE-2026-89022

Immediate Actions Required

Upgrade BookStack to version 26.05.5 or later without delay.
If upgrade is not immediately possible, disable all but one social login provider until the patch is applied.
Audit the social_accounts table for unexpected or duplicate driver_id values across providers.
Force session invalidation and require re-authentication for administrator accounts after upgrade.

Patch Information

The fix is included in BookStack 26.05.5. Refer to the Bookstack Release Announcement for release notes and upgrade guidance. The patch scopes the linked-account lookup by both driver and driver_id, restoring the provider-to-account binding.

Workarounds

Reduce enabled social providers to a single provider until upgrade is complete.
Restrict access to the BookStack instance behind a reverse proxy or VPN that requires primary authentication before reaching OAuth callback endpoints.
Remove social account links for high-privilege accounts and require local password authentication until the fix is deployed.

bash

# Configuration example: disable additional social providers in .env until patched
GITHUB_APP_ID=false
GOOGLE_APP_ID=false
OKTA_BASE_URL=false
# Keep only one provider enabled, for example:
# AZURE_APP_ID=your-app-id