## Summary
CVE-2026-51584 affects usememos (Memos) up to v0.27.1, where the OAuth2/SSO sign-in flow can be abused for remote account takeover. The vulnerable SignIn handler matches a local account using only an attacker-influenced identifier from the IdP, without binding to the IdP’s stable subject claim.
## Technical Details
- Vulnerable code path: server/router/api/v1/auth_service.go in the SignIn handler, specifically the ssoCredentials branch.
- Root cause: the SSO flow performs local user lookup using only userInfo.Identifier (e.g., username/email/preferred_username/name), e.g. store.FindUser{ Username: &userInfo.Identifier }.
- Missing binding: there is no external-identity binding (e.g., no user_identity table or equivalent mapping such as external_sub / IdP stable subject). As a result, the IdP’s stable sub claim is not used to ensure the authenticated external identity corresponds to the intended local account.
- Authentication outcome: the matched existingUser is then used by doSignIn() to issue a JWT containing existingUser.ID, existingUser.Username, and existingUser.Role, enabling privilege escalation when the attacker maps to an admin account.
- Attack prerequisites (from references): SSO must be enabled against a public IdP where the mapped identifier is attacker-controllable.
## Affected
- usememos / memos versions: ≤ v0.27.1
- Fixed in: v0.28.0 (fix commit d688914b)
## Impact
- Account takeover of arbitrary local users (including admins) via SSO.
- Privilege escalation through issuance of JWTs tied to the victim local user.
## Mitigation
1. Upgrade usememos to v0.28.0 or later (includes fix commit d688914b).
2. If immediate upgrade is not possible, review SSO configuration to ensure the identifier used for account linking is not attacker-controlled; ensure stable IdP subject binding is enforced.
3. After upgrading, audit for any suspicious SSO logins and validate that local accounts are correctly bound to the IdP stable subject claim (e.g., sub).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-287