{"id":"CVE-2026-126542","kind":"vulnerability","aliases":["CVE-2026-126542"],"related":[],"title":"WWBN AVideo: social login lets attackers sign in as any user","description":"WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.","summary":"AVideo versions 6.5 through 29.7.1 trust the display name returned by X, Facebook, Yahoo or LinkedIn social login. An attacker sets a display name to a victim's username and omits the email, and the site logs them in as that account, including administrators, with no password.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WWBN AVideo","fixed":["commit d34ccf23b37a127a68478d66ac00b450b5788bad"],"affected":">= 6.5, <= 29.7.1 (master before d34ccf23b37a127a68478d66ac00b450b5788bad)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["authentication-bypass","avideo","other","php","self-hosted","social-login"],"not_affected_if":["fixed-commit-applied","social-login-disabled","version-outside-range"],"how_to_check":"1. Check your AVideo version: 6.5 through 29.7.1 is affected, as is any master before commit d34ccf2.\n2. In the admin plugin list, check whether LoginTwitter (X), LoginFacebook, LoginYahoo or LoginLinkedin is enabled. If none is, the vulnerable path is not reachable.\n3. Check that objects/login.json.php no longer falls back to $userProfile->displayName as the username (fixed in d34ccf2).\n4. Review sessions and logins for admin and other accounts that were not created through social login.","fix":"No tagged release stated yet. Vendor patch is commit d34ccf23b37a127a68478d66ac00b450b5788bad (master, 2026-11-09), which binds social login to the provider identity. Update to a build that includes it; v29.7.1 and earlier are vulnerable.","status":"open","published_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:25:47+00:00","updated_at":"2026-11-11T01:26:10+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-11T01:25:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WWBN AVideo: social login lets attackers sign in as any user","impact":"high","summary":"AVideo versions 6.5 through 29.7.1 trust the display name returned by X, Facebook, Yahoo or LinkedIn social login. An attacker sets a display name to a victim's username and omits the email, and the site logs them in as that account, including administrators, with no password.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","self-hosted","social-login","php"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any user, including administrators, without a password","analyst_note":"Confirm the fixed version and vendor patch from the GitHub patch and vendor advisory linked in the sources; the fix is not stated in the provided text.","how_to_check":"- Check the installed AVideo version against the range 6.5 through 29.7.1 in the product's version file or admin panel\n- Check whether Hybridauth social login is enabled in the AVideo admin settings\n- unknown for further detail, as the sources do not say","plain_action":"","product_name":"WWBN AVideo","needs_analyst":true,"not_affected_if":["social-login-disabled","version-outside-range"],"who_is_affected":"AVideo sites from 6.5 through 29.7.1 that have social login enabled through Hybridauth with X, Facebook, Yahoo or LinkedIn are exposed, since login.json.php and oauth2.php accept the display name as the identity. Sites without these social login providers enabled, or running versions outside the range, are not affected according to the description.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000775,"input_tokens":4652,"output_tokens":620,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor patch from the GitHub patch and vendor advisory linked in the sources; the fix is not stated in the provided text.","search":"'-126542':14A,17A '-2026':13A,16A '29.7.1':36B,83C '6.5':34B,81C 'account':73B,134C 'administr':75B,136C 'allow':90C 'attack':6A,51B,92C,105C 'authent':21B,86C 'authentication-bypass':20B 'avideo':2A,19A,23B,32B,80C 'bypass':22B,87C 'caus':124C 'contain':84C 'cve':12A,15A 'display':39B,54B,103C,114C 'email':64B,123C 'facebook':44B,110C 'host':28B 'hybridauth':100C 'includ':74B,135C 'let':5A 'linkedin':47B,113C 'log':68B,94C,129C 'login':4A,31B,49B,102C 'login.json.php':125C 'name':40B,55B,104C,115C 'oauth2.php':127C 'omit':62B 'password':78B,139C 'php':25B 'return':41B 'self':27B 'self-host':26B 'set':52B,107C 'sign':7A 'site':67B 'social':3A,30B,48B,101C 'social-login':29B 'trust':37B 'unauthent':91C 'user':11A,98C 'usernam':60B,120C 'version':33B 'via':99C 'victim':58B,118C 'vulner':88C 'withhold':122C 'without':137C 'wwbn':1A,18A,79C 'x':43B,109C 'yahoo':45B,111C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AVideo sites from 6.5 through 29.7.1 that have enabled a social login plugin (X, Facebook, Yahoo or LinkedIn). When the provider returns no email, the site uses the attacker-chosen display name or handle as the local username and logs in as the existing account with that name, with no password check. Administrator accounts are included. The mobile endpoint plugin/MobileManager/oauth2.php has the same flaw. Sites with no social login plugin enabled can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T01:26:10Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","run_id":3490},"products":{"at":"2026-11-11T01:26:10Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","run_id":3490},"how_to_check":{"at":"2026-11-11T01:26:10Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","run_id":3490},"who_affected":{"at":"2026-11-11T01:26:10Z","by":"analyst","doc":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","run_id":3490}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["avideo","wwbnavideo"],"ptokens":["avideo","wwbn"],"labels":["authenticationbypass","avideo","critical","other","php","selfhosted","sociallogin","vendor"],"campaign_type":null,"search_a":"'-126542':14A,17A '-2026':13A,16A 'attack':6A 'avideo':2A,19A 'cve':12A,15A 'let':5A 'login':4A 'sign':7A 'social':3A 'user':11A 'wwbn':1A,18A","search_b":"'29.7.1':36B '6.5':34B 'account':73B 'administr':75B 'attack':51B 'authent':21B 'authentication-bypass':20B 'avideo':23B,32B 'bypass':22B 'display':39B,54B 'email':64B 'facebook':44B 'host':28B 'includ':74B 'linkedin':47B 'log':68B 'login':31B,49B 'name':40B,55B 'omit':62B 'password':78B 'php':25B 'return':41B 'self':27B 'self-host':26B 'set':52B 'site':67B 'social':30B,48B 'social-login':29B 'trust':37B 'usernam':60B 'version':33B 'victim':58B 'x':43B 'yahoo':45B","search_c":"'29.7.1':83C '6.5':81C 'account':134C 'administr':136C 'allow':90C 'attack':92C,105C 'authent':86C 'avideo':80C 'bypass':87C 'caus':124C 'contain':84C 'display':103C,114C 'email':123C 'facebook':110C 'hybridauth':100C 'includ':135C 'linkedin':113C 'log':94C,129C 'login':102C 'login.json.php':125C 'name':104C,115C 'oauth2.php':127C 'password':139C 'set':107C 'social':101C 'unauthent':91C 'user':98C 'usernam':120C 'via':99C 'victim':118C 'vulner':88C 'withhold':122C 'without':137C 'wwbn':79C 'x':109C 'yahoo':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T16:43:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126542","severity":null,"published_at":"2026-11-11T01:17:15+00:00","modified_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126542:3490","url":null,"severity":null,"published_at":"2026-11-11T01:26:10+00:00","modified_at":"2026-11-11T01:26:10+00:00","first_seen_at":"2026-11-11T01:26:10+00:00","fetched_at":"2026-11-11T01:26:10+00:00","note":"Read GHSA-9rvm-cfc4-q9g9 and fix commit d34ccf2. Patch is a commit only; advisory names no release version after v29.7.1."}],"documents":[{"id":121294,"url":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121295,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T16:43:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":121296,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}