The flaw allows an attacker to create an unverified local account using a victim's email and then link a verified SSO identity to that account without confirming ownership. This effectively grants the attacker control over the victim's account, including access to project data, permissions, and the ability to use any local credentials. The weakness is an authentication bypass (CWE‑287) and an improper privilege management (CWE‑288). The CVSS score of 8.8 signals a high‑severity impact on confidentiality and integrity of all projects associated with the affected accounts.

The issue affects the open‑source boards application RARgames:4gaBoards, specifically any deployment of versions earlier than 3.3.8 where registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are all active and at least one of Google, GitHub, Microsoft, or OIDC SSO providers is configured. The vulnerability is mitigated in version 3.3.8 released in the Jan 2026 snapshot.

Without a verified email, an attacker can trigger the vulnerability through the public POST /api/register endpoint, creating an account that bypasses verification checks. The subsequent POST /api/access-tokens request authenticates the account even though isVerified is false. The app then matches the attacker’s email on the first SSO login and links the verified external identity, granting the attacker both local and SSO privileges. No exploit mitigation is listed in CISA KEV and the EPSS score is unavailable, but the high CVSS rating indicates that the vulnerability is readily exploitable once the application is reachable. The attack vector is remote over the network, requiring only the ability to send HTTP requests to the exposed API endpoints.