CyberRota Analysis
AI-GeneratedQueryWeaver is vulnerable to an authentication bypass that enables unauthenticated attackers to generate valid session tokens for existing accounts by exploiting the signup process with a known victim's email address. This flaw allows attackers to gain unauthorized access to user accounts without needing credentials, posing a significant risk to user data and privacy. Organizations using QueryWeaver should prioritize addressing this vulnerability to protect their users from potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.