CVE-2026-6266: Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

Awaiting analysis

Published 04-05-2026Last modified 27-08-2026

Vulnerability summary

CVE-2026-6266 is a high (CVSS 8.3) vulnerability. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.3/10

010

High · v3.1 (CVE.org)

EPSS score

0.40%

0%100%

Low · -0.18 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2026:13508 RHSA-2026:13512

Timeline

04-05-2026
PublishedVulnerability first disclosed.
27-08-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.