Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

AVideo lets attackers log in as any user

CVE-2026-126542 · published today
Summary

Versions 6.5 through 29.7.1 of AVideo let a stranger sign in as any existing account, including administrators, by tricking the social login feature. The attacker can fake a social media name to match a real user and gain access without a password. Apply the vendor's update or disable the Hybridauth social login until a patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wwbn avideo <= 29.7.1
Original advisory text
WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Sources
CVE-2026-126542 · NVD
CVE-2026-126542 · MITRE
Track software like this
Free during beta