---
id: "CVE-2026-122019"
kind: "vulnerability"
aliases: ["CVE-2026-122019"]
title: "6valley 16.0: social login flaw lets attackers bypass authorization remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "6valley", "fixed": [], "affected": "16.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["6valley", "other", "php", "self-hosted", "social-login"]
not_affected_if: ["social-login-disabled"]
published_at: "2026-11-04T22:17:55+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:11:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122019", "first_seen_at": "2026-11-04T23:08:48+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-122019-authorization-bypass-in-6amtech-6valley-ebc0fef02b84c603", "first_seen_at": "2026-11-04T23:11:46+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-122019-authorization-bypass-in-6amtech-6valley-ebc0fef02b84c603"]}]
exploit_sources: []
---

# 6valley 16.0: social login flaw lets attackers bypass authorization remotely

A flaw in the Social Login flow of 6amTech 6valley 16.0 lets a remote attacker manipulate the user_response argument of the existing-account-check endpoint. The attacker can bypass authorization, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:6valley affected 16.0 fixed no fixed version listed

## How to check

Check whether your 6amTech 6valley install is version 16.0 (admin panel footer or version file) and whether Social Login is enabled (Admin Panel > System Settings > 3rd Party > Social Media Login). Look in web logs for requests to /api/v1/auth/existing-account-check with unusual user_response values. Other versions: unknown, the CNA record names only 16.0.

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122019
- 2026-11-04T23:11:46+00:00 analyst https://radar.offseq.com/threat/cve-2026-122019-authorization-bypass-in-6amtech-6valley-ebc0fef02b84c603 — No vendor/maintainer advisory or fix found; NVD page returned no content, only CNA (VulDB) text via OffSeq/HOL rewrites. Affected 16.0 only per CNA; fix unknown, no vendor page to support fix-status none. CVSS 3.1 7.3 / 4.0 6.9 (VulDB). PoC claimed public but no link found. Nothing verified. Revisit when VulDB entry or 6amTech release notes appear.

## Documents

- [mentions] OffSeq Threat Radar: CVE-2026-122019 https://radar.offseq.com/threat/cve-2026-122019-authorization-bypass-in-6amtech-6valley-ebc0fef02b84c603

## From the sources

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_