Critical vulnerability
Critical authentication bypass in AVideo (GHSA-9rvm-cfc4-q9g9)
Authentication bypass in AVideo · Servers and applications
GHSA-9rvm-cfc4-q9g9
Authentication bypass / account takeover: Hybridauth social login (objects/login.json.php, plugin/MobileManager/oauth2.php) falls back to the provider's attacker-chosen displayName (X screen_name, Facebook/Yahoo/LinkedIn name) as the local username, attaches to the EXISTING local account with that username and logs in with login(true), no password check
- Severity
- Critical 9.8
- Published
- 9 Nov 2026
- Fixed in
- 00
| Software | Affected versions |
|---|---|
| AVideoServers and applications |
|
- GitHub Advisory Database https://github.com/advisories/GHSA-9rvm-cfc4-q9g9
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.