CVE-2026-34456

Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim’s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5.

• CWE-284

• https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896Patch
• https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5Product, Release Notes
• https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfgMitigation, Patch, Vendor Advisory

Published

Apr 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34450The Claude SDK for Python provides access to the Claude API …4.4
• CVE-2026-34451Claude SDK for TypeScript provides access to the Claude API …5.4
• CVE-2026-34452The Claude SDK for Python provides access to the Claude API …5.3
• CVE-2026-34453SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-34454OAuth2 Proxy is a reverse proxy that provides authentication…3.5
• CVE-2026-34455Hi.Events is an open-source event management and ticket sell…8.8
• CVE-2026-34457OAuth2 Proxy is a reverse proxy that provides authentication…9.1
• CVE-2026-34458Sandboxie-Plus is an open source sandbox-based isolation sof…8.8
• CVE-2026-34459Sandboxie-Plus is an open source sandbox-based isolation sof…8.8
• CVE-2026-3446When calling base64.b64decode() or related functions the dec…6
• CVE-2026-34460NamelessMC is website software for Minecraft servers. In ver…5.4
• CVE-2026-34461Sandboxie-Plus is an open source sandbox-based isolation sof…7.8