Servers and applications
GHSA-9rvm-cfc4-q9g9
Authentication bypass / account takeover: Hybridauth social login (objects/login.json.php, plugin/MobileManager/oauth2.php) falls back to the provider's attacker-chosen displayName (X screen_name, Facebook/Yahoo/LinkedIn name) as the local username, attaches to the EXISTING local account with that username and logs in with login(true), no password check
- Severity
- Critical 9.8
- Published
- 9 Nov 2026
- Last changed
- 9 Nov 2026
- Added to UpHeron
- 9 Nov 2026
- Fixed in
- 00
- Sources
- Project advisories (GitHub)
Affected software
| Software | Affected versions |
|---|---|
AVideoServers and applications · github:wwbn/avideo |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-9rvm-cfc4-q9g9
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9