A verification key issued for one tenant can authenticate the same email address on another tenant when the key lookup omits tenant scoping.Fider's advisory says an attacker needs an account on any tenant, without special privileges. The flaw can lead to unauthorized account access across tenants, while the default single-host mode is unaffected.
What it allows
How Does CVE-2026-65840 Cross the Fider Tenant Boundary?
Fider says its email verification lookup checks the key and its kind without checking the tenant identifier. Because verification records belong to tenants, that missing condition can return a record from a different tenant.
An attacker with an account on one tenant can obtain a verification key for their own email address. The advisory says that key may then authenticate the same address on another tenant, bypassing the separation between those tenants.
If the address already has an administrator account on the second tenant, the advisory says the session gains that account's access. If the address is absent, Fider may create a new account there without a tenant-local verification.
How Should Teams Interpret the Published Severity?
The GitHub CNA record gives CVSS 3.1 a 9.6 Critical rating. Its vector describes network access, low privileges, no user interaction, and high confidentiality and integrity impact.
The advisory's written CVSS section labels that same vector 8.5 High, while its displayed score card shows 9.6 Critical. This is a source inconsistency, so administrators should not treat either printed number alone as an exposure assessment.
What Is Known About Exploitation?
The CISA KEV catalog version dated November 10, 2026 did not list CVE-2026-65840. That dated catalog fact does not determine whether a particular Fider deployment was accessed through this flaw.
Fider's advisory includes a local demonstration of the cross-tenant outcome, not a report of a real-world intrusion. We therefore record observed exploitation as unknown and prioritize the documented tenant boundary risk.
Who is affected
Which Fider Deployments Are Affected?
The Fider advisory lists versions before 0.36.0 as affected and 0.36.0 as patched. Its impact description applies when the application runs in multi-tenant mode.
The advisory explicitly excludes the default single-host mode. Administrators should check both the installed version and the deployment mode before deciding whether this issue applies.
What Should Defenders Do?
Update affected multi-tenant Fider deployments to version 0.36.0 or later. After updating, confirm the installed release and review authentication activity across tenant boundaries.
As a Brandefense precaution, investigate sessions on a tenant whose verification began elsewhere, if your logs preserve that context. Review unexpected account creation and privileged access, then end suspect sessions while the account owner verifies access.
The vulnerability management guide supports update triage. The patch management glossary covers rollout checks, and the account takeover glossary explains the identity risk.
Timeline
- 2026-07-03
The Fider security advisory was published with the multi-tenant authentication flaw and version 0.36.0 fix.
- 2026-11-11
The GitHub CNA published the CVE-2026-65840 record, giving the existing advisory a searchable CVE identity.
What to do
-
Identify multi-tenant Fider deployments
Check each deployment's host mode and installed Fider version. Prioritize multi-tenant instances running a version earlier than 0.36.0.
-
Apply the fixed version
Update affected multi-tenant instances to Fider 0.36.0 or later. Confirm the version after rollout.
-
Review cross-tenant authentication
Where logs permit it, compare the verification's tenant with the resulting session's tenant. Investigate unexpected new accounts and privileged sessions.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-65840?
It is a Fider multi-tenant authentication flaw. A verification key from one tenant can authenticate the same email address on another tenant.
Is the default single-host deployment affected?
No. Fider's advisory says the default single-host mode is unaffected. The affected configuration is multi-tenant mode before version 0.36.0.
Which Fider version fixes the flaw?
Fider lists 0.36.0 as the patched version. Administrators should verify the deployed version and host mode together.
Why do the published CVSS scores differ?
The GitHub CNA record and advisory score card show 9.6 Critical. The advisory's written CVSS section labels the same vector 8.5 High.
When was CVE-2026-65840 published?
The Fider advisory was published on July 3, 2026. The GitHub CNA published the CVE record on November 11, 2026.
Sources
- Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKeyFider on GitHub Security Advisories
- CVE-2026-65840 RecordGitHub CNA via CVE Program
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
