CVE-2026-58422

26th percentile - higher than 26% of all known CVEs

A vulnerability in the OAuth sign-in callback mechanism silently re-enables accounts that were disabled by an administrator. Improper authorization allows bypassing administrative account lockout decisions.

The organization may lose control over system access, as disabled accounts (e.g., former employees or suspicious users) can be unknowingly restored, increasing the risk of unauthorized access and security breaches.

Immediately update the system to a version containing the fix for the OAuth callback authorization flaw. Until the update is applied, temporarily disable OAuth login or implement additional account validation rules.