6VALLEY · CVE-2026-122019 · Other
NO FIX YET
A flaw in the Social Login flow of 6amTech 6valley 16.0 lets a remote attacker manipulate the user_response argument of the existing-account-check endpoint. The attacker can bypass authorization, and a public exploit exists.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running 6amTech 6valley 16.0 with the Social Login flow enabled are exposed through the /api/v1/auth/existing-account-check endpoint. Installations without Social Login, or on other versions, are not covered by this entry. The sources do not say whether other versions are affected.
Not affected if social-login-disabled
Who cares 6valley, php, self-hosted, social-login
No fix yet, per the sources.
A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.