---
id: CVE-2026-10130
title: >-
  QueryWeaver contains an authentication bypass vulnerability that allows
  unauthenticated attackers to obtain valid session tokens for existing accounts
  by submitting a signup request with a known victim email address
summary: >-
  QueryWeaver contains an authentication bypass vulnerability that allows
  unauthenticated attackers to obtain valid session tokens for existing accounts
  by submitting a signup request with a known victim email address. The signup
  route unc…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-863
published: '2026-07-18'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10130'
references:
  - url: 'https://github.com/FalkorDB/QueryWeaver'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/FalkorDB/QueryWeaver/commit/e6a49f508191d0f1bdad0f146da43819e7849f18
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/queryweaver-authentication-bypass-via-email-signup-token-issuance-for-existing-accounts
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-07-19T08:30:40.278Z'
epss: 0.00559
epssPercentile: 0.45344
---

## Overview

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.