CVE-2026-6266 - Vulnerability Analysis
HighCVSS: 8.3Last Updated: May 4, 2026
AAP Gateway - Broken Access Control
Published: May 4, 2026Updated: May 4, 2026Remote Exploitable
Overview
AAP gateway 2.6 contains a broken access control caused by user auto-link strategy linking external IDP identities based on email without verifying ownership, letting remote attackers hijack or access accounts including admin, exploit requires manipulated IDP email.
Severity & Score
Severity: High
CVSS Score: 8.3
Impact
Remote attackers can hijack user or administrative accounts by exploiting email-based auto-linking without verification.
Mitigation
Update to the latest version with fixed user auto-link verification.
References
Related Resources
Details
- CVE ID
- CVE-2026-6266
- Severity
- High
- CVSS Score
- 8.3
- Type
- broken_access_control
- Status
- unconfirmed
CWE
- CWE-305
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L