---
id: "CVE-2026-126542"
page: "https://infrastack.ai/live/CVE-2026-126542"
kind: "vulnerability"
aliases: ["CVE-2026-126542"]
title: "WWBN AVideo: social login lets attackers sign in as any user"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WWBN AVideo", "fixed": ["commit d34ccf23b37a127a68478d66ac00b450b5788bad"], "affected": ">= 6.5, <= 29.7.1 (master before d34ccf23b37a127a68478d66ac00b450b5788bad)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["authentication-bypass", "avideo", "other", "php", "self-hosted", "social-login"]
not_affected_if: ["fixed-commit-applied", "social-login-disabled", "version-outside-range"]
published_at: "2026-11-11T01:17:15+00:00"
first_seen_at: "2026-11-11T01:24:34+00:00"
updated_at: "2026-11-11T01:26:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126542", "first_seen_at": "2026-11-11T01:24:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T01:26:10+00:00"}]
exploit_sources: []
---

# WWBN AVideo: social login lets attackers sign in as any user

Link for people: https://infrastack.ai/live/CVE-2026-126542 (this .md is for agents)

AVideo versions 6.5 through 29.7.1 trust the display name returned by X, Facebook, Yahoo or LinkedIn social login. An attacker sets a display name to a victim's username and omits the email, and the site logs them in as that account, including administrators, with no password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WWBN AVideo affected >= 6.5, <= 29.7.1 (master before d34ccf23b37a127a68478d66ac00b450b5788bad) fixed commit d34ccf23b37a127a68478d66ac00b450b5788bad

## How to check

1. Check your AVideo version: 6.5 through 29.7.1 is affected, as is any master before commit d34ccf2.
2. In the admin plugin list, check whether LoginTwitter (X), LoginFacebook, LoginYahoo or LoginLinkedin is enabled. If none is, the vulnerable path is not reachable.
3. Check that objects/login.json.php no longer falls back to $userProfile->displayName as the username (fixed in d34ccf2).
4. Review sessions and logins for admin and other accounts that were not created through social login.

## Fix

No tagged release stated yet. Vendor patch is commit d34ccf23b37a127a68478d66ac00b450b5788bad (master, 2026-11-09), which binds social login to the provider identity. Update to a build that includes it; v29.7.1 and earlier are vulnerable.

## Timeline

- 2026-11-11T01:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126542
- 2026-11-11T01:26:10+00:00 analyst — Read GHSA-9rvm-cfc4-q9g9 and fix commit d34ccf2. Patch is a commit only; advisory names no release version after v29.7.1.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login
- [fix] Patch: github.com https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad

## From the sources

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_