What’s Vulnerable › Vulnerabilities

CVE-2026-10130: QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-18 · updated 2026-10-24
• Weakness: CWE-863

Description

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.

Affected products

• FalkorDB QueryWeaver: all versions

References

• https://github.com/FalkorDB/QueryWeaver
• https://github.com/FalkorDB/QueryWeaver/commit/e6a49f508191d0f1bdad0f146da43819e7849f18
• https://www.vulncheck.com/advisories/queryweaver-authentication-bypass-via-email-signup-token-issuance-for-existing-accounts

Get alerted when CVE-2026-10130 or the next vulnerability affects your stack