CVE-2026-58422

6th percentile — higher than 6% of all known CVEs

An improper authorization vulnerability in the OAuth sign-in callback silently re-enables accounts that were disabled by an administrator. This bypasses access control policies without the administrator's knowledge.

The organization loses control over disabled accounts, which can be reused for unauthorized access, increasing the risk of security breaches and data loss.

Immediately update the system to a patched version that fixes this vulnerability. As a temporary workaround, disable OAuth login or implement additional account status verification mechanisms.