점검 대응높음KEV 미등록
CVE-2026-10130
FalkorDB QueryWeaver 취약점
QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.
- 대응 우선순위
- 점검
- CVSS
- 8.8
- EPSS
- 0.37% 백분위 29.3% · 2026.08.03 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.19