CVE-2026-108550
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
iflytek skillhub
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.2.22skillhubCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
Text from CVE List
Affected versions 1
- skillhubaffected: all versions before 0.2.22CVE List
References 6
- github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4Fixvia CVE List
- github.com/iflytek/skillhub/releases/tag/v0.2.22Fixvia CVE List
- vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flowAdvisoryvia CVE List
- github.com/iflytek/skillhub/issues/921Referencevia CVE List
- github.com/iflytek/skillhubReferencevia CVE List
- github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109Referencevia CVE List