bbs-go Auth Bypass Lets Attackers Impersonate Users via Google Tokens

Remote attackers can bypass authentication in bbs-go by exploiting a flaw in the Google One Tap login endpoint. Versions through 4.4.6 fail to validate the audience claim in Google ID tokens, enabling session hijacking.

What happened

The bbs-go forum software, developed by mlogclub, contains an authentication bypass vulnerability tracked as CVE-2026-111639. The flaw exists in the /api/login/google_one_tap endpoint of versions up to 4.4.6. Attackers can exploit this by submitting Google ID tokens that were issued to any OAuth client, not just the application's own client.

Because the application never checks the audience claim within the token, it accepts tokens intended for other services. An attacker operating their own Google OAuth client can capture a victim's Google-signed ID token. They can then replay this token to the vulnerable bbs-go instance to obtain an authenticated session as the victim's Google-linked account.

Why it matters

This vulnerability is rated CVSS 8.6 high by the National Vulnerability Database. It falls under CWE-287, which covers improper authentication. The severity stems from the fact that no additional credentials or complex exploits are required to gain access.

Attackers do not need to log in normally or steal passwords. They simply need to intercept or generate a valid Google ID token and present it to the flawed endpoint. This allows them to impersonate any user linked to Google on the forum.

What to watch

• Monitor vendor announcements for mlogclub regarding bbs-go updates.
• Check server logs for unusual login patterns via the Google One Tap endpoint.
• Review OAuth client configurations to ensure tokens are scoped correctly.
• Look for successful authentication events from unexpected IP addresses or user agents.

Who needs to act first

Teams should prioritize systems that expose the bbs-go forum to the internet without additional access controls. Identify all instances of bbs-go running version 4.4.6 or earlier. Isolate these systems from untrusted networks if possible to reduce exposure while a fix is developed. Verify that no unauthorized sessions have been established by reviewing recent login logs. Implement strict network segmentation to limit access to the API endpoint until a vendor patch is available.

Background: OAuth

OAuth is a protocol for granting limited access to resources without sharing credentials. SSO is a pattern that lets users access multiple apps with one login. They solve different problems: OAuth handles authorization, while SSO handles authentication and session management.

Read the full guide: OAuth vs SSO: How to Choose the Right Identity Protocol

What to do and how to stay safe: bbs-go

• Verify the current version of bbs-go on all servers to see if it is 4.4.6 or earlier.
• Restrict access to the /api/login/google_one_tap endpoint to trusted IP addresses only.
• Monitor authentication logs for signs of token replay attacks or unusual session creation.
• Prepare to apply a vendor update immediately when a patched version is released.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which software is affected by this vulnerability?

mlogclub bbs-go versions up to and including 4.4.6 are affected by this authentication bypass flaw.

How do attackers exploit this vulnerability?

Attackers submit Google ID tokens issued to any OAuth client to the login endpoint, bypassing the missing audience claim check.

Is there a fix available yet?

No fix has been confirmed yet; users should monitor for updates from the vendor and apply mitigations.