CVE-2026-6266: AAP Gateway Email Auto-Link Flaw Allows Account Hijack

The National Vulnerability Database has detailed CVE-2026-6266, a critical vulnerability in the AAP gateway. This flaw, introduced in AAP 2.6, stems from an insecure user auto-link strategy that automatically connects an external Identity Provider (IDP) identity to an existing AAP user account. The core issue is a lack of email ownership verification during this auto-linking process.

This oversight creates a clear path for remote attackers. By manipulating the email address provided by an IDP, an attacker can effectively hijack a victim’s account. This includes high-privilege administrative accounts, leading to unauthorized access and significant compromise. The National Vulnerability Database assigns this a CVSS score of 8.3 (High), underscoring the severe impact on confidentiality and integrity.

The attacker’s calculus here is straightforward: exploit the trust boundary between the IDP and the AAP gateway. Without proper email verification, the system blindly links accounts based on a potentially spoofed identifier. Defenders must recognize that this isn’t a complex exploit; it leverages a fundamental design flaw in identity management, making it highly attractive to adversaries seeking quick, high-impact access.