How do I check whether I am affected by CVE-2026-126542?

1. Check your AVideo version: 6.5 through 29.7.1 is affected, as is any master before commit d34ccf2. 2. In the admin plugin list, check whether LoginTwitter (X), LoginFacebook, LoginYahoo or LoginLinkedin is enabled. If none is, the vulnerable path is not reachable. 3. Check that objects/login.json.php no longer falls back to $userProfile->displayName as the username (fixed in d34ccf2). 4. Review sessions and logins for admin and other accounts that were not created through social login.

What is the fix for CVE-2026-126542?

No tagged release stated yet. Vendor patch is commit d34ccf23b37a127a68478d66ac00b450b5788bad (master, 2026-11-09), which binds social login to the provider identity. Update to a build that includes it; v29.7.1 and earlier are vulnerable.

Post Share

CRITICAL9.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

WWBN AVIDEO · CVE-2026-126542 · Other

WWBN AVideo: social login lets attackers sign in as any user

Q: Who is not affected by CVE-2026-126542?

Not affected if: fixed-commit-applied, social-login-disabled, version-outside-range.

FIX → commit d34ccf23b37a127a68478d66ac00b450b5788bad ✓ verified

AVideo versions 6.5 through 29.7.1 trust the display name returned by X, Facebook, Yahoo or LinkedIn social login. An attacker sets a display name to a victim's username and omits the email, and the site logs them in as that account, including administrators, with no password.

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 11

Self-hosted AVideo sites from 6.5 through 29.7.1 that have enabled a social login plugin (X, Facebook, Yahoo or LinkedIn). When the provider returns no email, the site uses the attacker-chosen display name or handle as the local username and logs in as the existing account with that name, with no password check. Administrator accounts are included. The mobile endpoint plugin/MobileManager/oauth2.php has the same flaw. Sites with no social login plugin enabled can skip it.

WWBN AVideo>= 6.5, <= 29.7.1 (master before d34ccf23b37a127a68478d66ac00b450b5788bad)fixed in commit d34ccf23b37a127a68478d66ac00b450b5788bad

Not affected if fixed-commit-applied, social-login-disabled, version-outside-range

Who cares authentication-bypass, avideo, php, self-hosted, social-login

02 · How to check

✓ Verified Nov 11

Check your AVideo version: 6.5 through 29.7.1 is affected, as is any master before commit d34ccf2.
In the admin plugin list, check whether LoginTwitter (X), LoginFacebook, LoginYahoo or LoginLinkedin is enabled. If none is, the vulnerable path is not reachable.
Check that objects/login.json.php no longer falls back to $userProfile->displayName as the username (fixed in d34ccf2).
Review sessions and logins for admin and other accounts that were not created through social login.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 11, 2026

How it unfolded

3 events · Nov 9, 2026 → Nov 11, 2026

Nov 9, 202616:43 UTCgithub.com Vendor advisory: github.com
Nov 11, 202601:24 UTCNVD CVE-2026-126542
Nov 11, 202601:26 UTCInfraStack Analyst Read GHSA-9rvm-cfc4-q9g9 and fix commit d34ccf2. Patch is a commit only; advisory names no release version after v29.7.1.

What the sources say, verbatim

407 characters

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

Sources and references

NVD: CVE-2026-126542Nov 11, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next WWBN AVideo threat the day it hits your stack.

Start free

Post Share

CRITICAL9.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

WWBN AVIDEO · CVE-2026-126542 · Other

WWBN AVideo: social login lets attackers sign in as any user

FIX → commit d34ccf23b37a127a68478d66ac00b450b5788bad ✓ verified

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 11

WWBN AVideo>= 6.5, <= 29.7.1 (master before d34ccf23b37a127a68478d66ac00b450b5788bad)fixed in commit d34ccf23b37a127a68478d66ac00b450b5788bad

Not affected if fixed-commit-applied, social-login-disabled, version-outside-range

Who cares authentication-bypass, avideo, php, self-hosted, social-login

02 · How to check

✓ Verified Nov 11

Check your AVideo version: 6.5 through 29.7.1 is affected, as is any master before commit d34ccf2.
In the admin plugin list, check whether LoginTwitter (X), LoginFacebook, LoginYahoo or LoginLinkedin is enabled. If none is, the vulnerable path is not reachable.
Check that objects/login.json.php no longer falls back to $userProfile->displayName as the username (fixed in d34ccf2).
Review sessions and logins for admin and other accounts that were not created through social login.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 11, 2026

How it unfolded

3 events · Nov 9, 2026 → Nov 11, 2026

Nov 9, 202616:43 UTCgithub.com Vendor advisory: github.com
Nov 11, 202601:24 UTCNVD CVE-2026-126542
Nov 11, 202601:26 UTCInfraStack Analyst Read GHSA-9rvm-cfc4-q9g9 and fix commit d34ccf2. Patch is a commit only; advisory names no release version after v29.7.1.

What the sources say, verbatim

407 characters

Sources and references

NVD: CVE-2026-126542Nov 11, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next WWBN AVideo threat the day it hits your stack.

Start free

WWBN AVideo: social login lets attackers sign in as any user

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next WWBN AVideo threat the day it hits your stack.

WWBN AVideo: social login lets attackers sign in as any user

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next WWBN AVideo threat the day it hits your stack.

03 · The fix