SkillHub before 0.2.22 Account Takeover via Account Merge Flow

Advisories

SkillHub before 0.2.22 Account Takeover via Account Merge Flow

severity: high
date: 10/10/2026
Affecting: skillhub >= 0, < 0.2.22
CVE: CVE-2026-108550
CWE: CWE-863 Incorrect Authorization
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: GitHub Issue #921
https://github.com/iflytek/skillhub
https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4
skillhub v0.2.22 Release Notes
https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109
Credit: George Chen
Description: SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo