A critical authentication bypass in WWBN AVideo 6.5 through 29.7.1 can let unauthenticated attackers log in as an existing account, potentially including administrators, by abusing Hybridauth social login display names on instances where that login path is reachable.
What Is It
CVE-2026-126542 is an authentication bypass (CWE-290) in WWBN AVideo's Hybridauth social login integration. According to the advisory, an attacker sets their X, Facebook, Yahoo or LinkedIn display name to match a victim's AVideo username, and the social account does not share an email address. AVideo's login.json.php or oauth2.php then logs the attacker into the matching account without a password.
The referenced code is at objects/login.json.php (lines 133–145) and plugin/MobileManager/oauth2.php (lines 90–102) in the v29.7.1 source tree.
VulnCheck disclosed the flaw, and NVD has published the record. NVD currently lists it as "Deferred."
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
The attack works over the network with low complexity. It needs no privileges and no action from the victim. Based on the advisory, the attacker needs a supported social media account whose display name they control and that does not share an email address, and the target instance must expose Hybridauth social login. If an administrator account is matched, the attacker could gain full control of the AVideo instance. The CVSS vector rates confidentiality, integrity and availability impact as high.
Exploitation status: CVE-2026-126542 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources don't confirm any active exploitation.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: 6.5 through 29.7.1 (inclusive)
- Exposure condition: Hybridauth social login reachable through
login.json.phpor the MobileManager plugin'soauth2.php
No CPE entries were listed in the NVD record.
Patch Status
The references include a fix commit in the WWBN AVideo repository (d34ccf23b37a127a68478d66ac00b450b5788bad) and a GitHub Security Advisory (GHSA-9rvm-cfc4-q9g9). The supplied data does not name a fixed release version.
There is no CISA KEV required action or due date because the CVE is not in the KEV catalog. Administrators running AVideo 6.5–29.7.1 should:
- Review the GitHub advisory and fix commit.
- Update to a build that includes the fix.
- Check whether Hybridauth social login is exposed on their instance in the meantime.