CVE-2026-10130: Falkordb Queryweaver

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.

Affected products

• Falkordb Queryweaver

Published 2026-07-18. Last modified 2026-07-23.