PT-2026-60993 · Unknown · Queryweaver

Katriel Moses · CVE-2026-10130 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions QueryWeaver (affected versions not specified)

Description An authentication bypass allows unauthenticated attackers to obtain valid session tokens for existing accounts. By submitting a signup request with a known victim email address, the server uses a Cypher MERGE operation to unconditionally create and link a new token to the matching Identity before verifying if the email is already associated with an account. This results in the server returning an authenticated session token for the victim without requiring credentials or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-10130

Affected Products

Queryweaver

References · 6

• https://github.com/FalkorDB/QueryWeaver/commit/e6a49f508191d0f1bdad0f146da43819e7849f18 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10130 · Security Note
• https://github.com/FalkorDB/QueryWeaver · Note
• https://twitter.com/infoflowcloud/status/2078619858489471087 · Twitter Post
• https://twitter.com/CVEnew/status/2078618646461456492 · Twitter Post
• https://vulncheck.com/advisories/queryweaver-authentication-bypass-via-email-signup-token-issuance-for-existing-accounts · Note