Plane, an open‑source project management tool, includes OAuth authentication against Gitea and self‑managed GitLab. Before version 1.4.0 the application blindly trusts the email address returned by the OAuth provider when the provider does not verify the user’s ownership of that address. An attacker who controls an OAuth identity can set its unverified email to any address, and when that address matches a local Plane user the application logs the attacker into that user’s account without a password. The result is an account takeover that compromises confidentiality and integrity of the victim’s data. This reflects authentication bypass (CWE‑287) and inadequate verification of third‑party email ownership (CWE‑290).

The affected product is makeplane:plane. All releases prior to 1.4.0 are vulnerable. The issue manifests only when the OAuth provider is a Gitea instance or a self‑managed GitLab installation that has email confirmation disabled. Standard providers such as GitHub, GitLab.com, and Google are not impacted because they always supply verified email addresses.

The CVSS score of 9.1 indicates high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. Plane is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. This vulnerability can be exploited when the user authenticates through a vulnerable OAuth provider, allowing an attacker to gain full access to the victim’s account without knowing the password.