CVE-2026-6266 Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Problem types: cwe_id: CWE-305
description: Authentication Bypass by Primary Weakness
Affected products: vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el10
cpe:/a:redhat:ansible_automation_platform:2.6::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el10
cpe:/a:redhat:ansible_automation_platform:2.6::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el10
cpe:/a:redhat:ansible_automation_platform:2.6::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.6
cpes: cpe:/a:redhat:ansible_automation_platform:2.6::el9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by Robin Bobbitt (Red Hat).
Published: 2026-05-04T13:47:07.260Z