CVE-2026-126542
Last modified
CVE-2026-126542 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password..
Description
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-126542?
How severe is CVE-2026-126542?
How do I fix CVE-2026-126542?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12650A Deserialization of Untrusted Data vulnerability in Ivanti …8.8
- CVE-2026-12651A Deserialization of Untrusted Data vulnerability in Ivanti …8.8
- CVE-2026-126537The Ninja Forms - File Uploads add-on for WordPress is vulne…9.1
- CVE-2026-126539Directus before 12.1.0 contains an authorization bypass vuln…8.1
- CVE-2026-12654The Payment Plugins for Stripe WooCommerce plugin for WordPr…5.3
- CVE-2026-126541WWBN AVideo through 29.7.1 contains a missing authorization …8.1
- CVE-2026-126543WWBN AVideo through 29.7.1 contains an improper payment veri…7.5
- CVE-2026-126544WWBN AVideo 6.5 through 29.7.1 contains an email verificatio…4.3
- CVE-2026-126545WWBN AVideo through 29.7.1 contains a missing authorization …4.3
- CVE-2026-126546Viber for iOS through 29.4.0.24 fails to validate the logica…4.3
- CVE-2026-12655A security issue exists within 1732E ArmorBlock® I/O, where …8.8
- CVE-2026-126559Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cros…4.8
Are you affected by CVE-2026-126542?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST