CVE-2026-122019: 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization
A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument userresponse leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can target the affected API endpoint without authentication or user interaction. Exploitation involves manipulating the user_response argument sent to /api/v1/auth/existing-account-check.
Is public exploit code available?
Yes. The available data states that a public exploit exists and may be used.
Which versions are confirmed affected?
The vulnerability data identifies 6amTech 6valley version 16.0 as impacted. No unaffected or fixed version is provided.