CVE-2026-55987

HighCVSS 8.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

OAuth2 sign-in can reactivate an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009).

Administrators may be unable to effectively deactivate accounts, posing a risk of unauthorized access.

Update the system and ensure deactivated accounts cannot be reactivated via OAuth2.

Original NVD description (English source)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)