CVE-2026-108550
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 10, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 10, 2026
Description
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
skillhubiflytek |
|
References
- GitHub Issue #921issue-tracking
- https://github.com/iflytek/skillhubproduct
- https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4patch
- skillhub v0.2.22 Release Notesrelease-notes
- https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109technical-description
- VulnCheck Advisory: SkillHub before 0.2.22 Account Takeover via Account Merge Flowthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.