CVE-2026-126542

Summary

An authentication bypass flaw in WWBN AVideo allows unauthenticated attackers to impersonate any user—including administrators—by manipulating Hybridauth social login display names without needing a password. This occurs because the system incorrectly trusts the display name field as a unique username during OAuth-based login, ignoring email verification.

Exploitability

Exploitation is trivial for remote attackers with no authentication or user interaction required; only knowledge of a target username and ability to set a social media display name is needed.

Blast radius

Successful exploitation grants full account access to any user—including privileged accounts—enabling complete compromise of confidentiality, integrity, and availability across the application.

Detection

Defenders should monitor login.json.php and oauth2.php access logs for requests with missing or empty email parameters combined with non-empty display_name values, especially when those display names match existing usernames; repeated such requests from the same IP may indicate exploitation attempts.

Prioritized remediation

Upgrade to AVideo version 29.7.2 or later, which addresses the authentication bypass by enforcing email-based user lookup and rejecting login attempts where email is missing or unverified during Hybridauth flow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.