Rote versions 1.2.0 through 2.6.0 contain an authorization bypass in the OAuth account bind/merge endpoint. CVE-2026-126801 allows an authenticated user to merge an OAuth-bound account into their own account by supplying a public target user ID and a GitHub or Apple identifier.
The vulnerability is an object-authorization failure. The application appears to accept the caller as authenticated but does not adequately prove that the caller owns the account or provider identity being merged.
Identity linking is an authority decision
OAuth login often creates a local link between an application account and a provider identifier. That link is a durable identity claim. A merge operation combines two sets of sessions, permissions and data, so it should require proof of control over both sides.
An attacker who is already logged in can abuse the endpoint if the target's local user ID and external provider identifier are discoverable. Public IDs are not secrets. Hiding them in a UI does not replace an ownership check.
The advisory describes account takeover through the merge. The exact recovery or undo behavior is not documented in the public record. Teams should therefore treat a successful merge as a possible change to identity ownership, not merely a duplicate-account cleanup problem.
Affected deployments
Rote 1.2.0 through 2.6.0 is affected. The vendor patch is in commit 865d69fceb9c1f1a0d30923fae7cef072a38b22b and pull request 420. Operators should verify that the deployed image or source build contains the authorization change.
If the deployment is user-facing, review OAuth provider configuration and whether account linking is enabled. Disable the bind/merge feature at the reverse proxy or application layer only if that can be done without breaking login.
Response evidence
Collect application audit logs for requests to the OAuth bind or merge route. Compare the authenticated local account, the target existingUserId and the GitHub or Apple identifier. A successful merge should have a clear user-initiated proof record that connects both identities.
Check for sessions created after an unexpected merge, changes to email addresses, provider links, roles or account recovery settings. Notify users if their identity link may have been changed and require reauthentication after the fix.
Do not assume that an OAuth provider token alone proves account ownership. The provider may issue a valid assertion while the local merge endpoint makes the authorization decision.
Fix and verify
Deploy the patched build and test the merge endpoint with two accounts controlled by the same test administrator. Confirm that a request for a target account is rejected unless the caller can prove ownership. Test both GitHub and Apple flows if both are enabled.
Review the application's logs for any merge that lacks a source-side challenge, reauthentication event or explicit consent record. Keep the provider subject identifiers in the audit trail without exposing unnecessary personal data.
The broader lesson is that OAuth reduces password handling but does not eliminate application authorization. Linking and merging identities are privileged operations, and they need the same object-level checks as role changes or data transfers.