CVE-2026-63398

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.

• CWE-287

• https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071
• https://github.com/roostorg/coop/pull/783
• https://github.com/roostorg/coop/releases/tag/1.0.2
• https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63387Libevent is an event notification library. Prior to 2.1.13 a…7
• CVE-2026-63388Libevent is an event notification library. Prior to 2.1.13 a…8.4
• CVE-2026-6339Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail …4.3
• CVE-2026-63393OpenSearch SQL supports querying OpenSearch data using SQL a…8.7
• CVE-2026-63396Coop is an open source review and moderation tool from ROOST…8.7
• CVE-2026-63397remorses/genql before version 6.3.4 allows an authenticated …6.4
• CVE-2026-63399Coop is an open source review and moderation tool from ROOST…6.9
• CVE-2026-6340Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5
• CVE-2026-63400Coop is an open source review and moderation tool from ROOST…2.3
• CVE-2026-63401Coop is an open source review and moderation tool from ROOST…5.3
• CVE-2026-63402i18next is an internationalization framework for JavaScript.…5.9
• CVE-2026-63403Faktory is a language-agnostic background job server. In ver…8.7