Vulnerability details
CVE-2026-126542
WWBN AVideo
WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
CVSS 4.0
9.3Critical
Official description
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WWBN | AVideo | 6.5 ≤ v ≤ 29.7.1 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9 vendor-advisory
- https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad patch
- https://github.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145 technical-description
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102 technical-description
- https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-11
- Last updated
- 2026-11-11
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 14 · Low
Exploit prediction (EPSS)
No EPSS score has been published for this CVE yet.
Weaknesses (CWE)
- CWE-290Authentication Bypass by Spoofing