{"id":"CVE-2026-126542","published":"2026-11-11T01:17:15.547","lastModified":"2026-11-11T01:17:15.680","description":"WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145","tags":[]},{"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102","tags":[]},{"url":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","tags":[]},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9","tags":[]},{"url":"https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login","tags":[]}],"exploitRefs":[{"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145","tags":[]},{"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102","tags":[]},{"url":"https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad","tags":[]},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9","tags":[]}],"hasPoc":true,"ai":{"summary":"An authentication bypass flaw in WWBN AVideo allows unauthenticated attackers to impersonate any user—including administrators—by manipulating Hybridauth social login display names without needing a password. This occurs because the system incorrectly trusts the display name field as a unique username during OAuth-based login, ignoring email verification.","exploitability":"Exploitation is trivial for remote attackers with no authentication or user interaction required; only knowledge of a target username and ability to set a social media display name is needed.","blast_radius":"Successful exploitation grants full account access to any user—including privileged accounts—enabling complete compromise of confidentiality, integrity, and availability across the application.","remediation":"Upgrade to AVideo version 29.7.2 or later, which addresses the authentication bypass by enforcing email-based user lookup and rejecting login attempts where email is missing or unverified during Hybridauth flow.","detection":"Defenders should monitor login.json.php and oauth2.php access logs for requests with missing or empty email parameters combined with non-empty display_name values, especially when those display names match existing usernames; repeated such requests from the same IP may indicate exploitation attempts.","tags":["auth-bypass","oauth","social-login","web-app","no-password"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:53:46.353Z"}}