The vulnerability exposes an authentication bypass in the OAuthService::findOrCreateLocalUser() function, which associates OIDC identities with local users solely based on email address. The function ignores whether the email has been verified, allowing an attacker to register an identity provider account using a victim’s unverified email and subsequently log in as that user. This can result in full account takeover, including privileged accounts such as the super‑admin, and the attacker retains access even after the victim resets their password.

The issue affects all versions of the Databasement application released by David‑Crty prior to version 1.10.9. Clients running 1.10.8 or older are vulnerable; upgrades to 1.10.9 or later are required to mitigate the flaw.

With a CVSS score of 9.2, the vulnerability is considered critical. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog; however, the attack vector is an OIDC identity provider that can supply an unverified email. An attacker can exploit this by creating a malicious provider account and then leveraging it to impersonate any local user. The lack of email verification makes the exploitation condition trivial once the attacker controls the provider or has access to a victim’s email address. Because the flaw permits unrestricted account takeover, the risk remains high.