by Kastro
Paper/Archive/CVE-2026-126542

CVE-2026-126542

WWBN AVideo — WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

Affected

ProductAffectedFixed inSource
AVideo6.5 – 29.7.1–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

advisorygithub.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9patchgithub.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788badwriteupgithub.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145writeupgithub.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102writeupvulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login