The vulnerability, identified as CWE-287, is an authentication bypass in bbs-go 4.4.6 that allows remote attackers to submit any Google ID token to the /api/login/google_one_tap endpoint. Because the service does not validate the aud claim, an attacker who owns a separate Google OAuth client can capture a victim's signed ID token and replay it, establishing an authenticated session on behalf of the victim. This results in remote account takeover, giving full access to the victim’s account and all associated data.

The affected product is mlogclub's bbs-go version 4.4.6. Attackers who can access the /api/login/google_one_tap endpoint of this specific version can exploit the flaw. No other versions are listed as affected by the CNA, so deployment of any newer release would avoid the issue.

The vulnerability scores a CVSS score of 8.6, indicating high severity. EPSS is not available, but the lack of an EPSS does not imply low exploitation likelihood; the technical specifics make the flaw easy to exploit in any system that exposes the endpoint. The vulnerability is not listed in the CISA KEV catalog, but the risk remains significant, especially for services handling sensitive user data. The attack requires only the ability to submit a crafted ID token to the exposed endpoint, making remote exploitation straightforward for attackers who can obtain or forge tokens.