CVE-2026-126542— WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

Quick assessment

Affected

WWBN AVideo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WWBN AVideo 6.5 至 29.7.1 版本存在身份验证绕过漏洞，允许未认证的攻击者通过 Hybridauth 社交登录的显示名称，以任意用户的身份登录。攻击者可将其在 X（原 Twitter）、Facebook、Yahoo 或 LinkedIn 上的显示名称设置为受害者的用户名，同时不提供电子邮件地址，从而利用 login.json.php 或 oauth2.php 脚本，无需密码即以该账户（包括管理员账户）身份登录。

CVSS 9.8 · Critical Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

Source: CVE Program / CVE List V5

Vulnerability Description

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用欺骗进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WWBN	AVideo	6.5 ~ 29.7.1	-

II. Public POCs for CVE-2026-126542

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126542

请登录查看更多情报信息。

Other References for CVE-2026-126542 (5)

https://github.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145 technical-description
https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad patch
https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102 technical-description
https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9 vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-social-login third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126542

Same Patch Batch · WWBN · 2026-11-11 · 5 CVEs total

CVE-2026-126541	8.1 HIGH	WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
CVE-2026-126543	7.5 HIGH	WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
CVE-2026-126545	4.3 MEDIUM	WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API
CVE-2026-126544	4.3 MEDIUM	WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

IV. Related Vulnerabilities

Same product: AVideo

Same vendor: WWBN

Same weakness: CWE-290