CVE-2026-126542: WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

Q: Which deployments are exposed to this issue?

WWBN AVideo versions 6.5 through 29.7.1 are affected where users can authenticate through Hybridauth social login using X, Facebook, Yahoo, or LinkedIn.

Q: What does an attacker need to exploit the bypass?

The attacker does not need an AVideo account, password, or user interaction. They need to use a supported social-login provider, set that provider account's display name to the target AVideo username, and withhold an email address during login.

Q: How serious is successful exploitation?

An attacker can authenticate as any target user, including an administrator. This can result in complete compromise of confidentiality, integrity, and availability within the affected AVideo instance.

Published Nov 11, 2026

Updated

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

Affected Software

1 affected component

WWBN AVideo>=6.5<=29.7.1

Event History

Nov 11, 2026

CVE Published

via MITRE·12:58 AM

Data Sourced

via MITRE·12:58 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

WWBN AVideo versions 6.5 through 29.7.1 are affected where users can authenticate through Hybridauth social login using X, Facebook, Yahoo, or LinkedIn.

What does an attacker need to exploit the bypass?

The attacker does not need an AVideo account, password, or user interaction. They need to use a supported social-login provider, set that provider account's display name to the target AVideo username, and withhold an email address during login.

How serious is successful exploitation?

An attacker can authenticate as any target user, including an administrator. This can result in complete compromise of confidentiality, integrity, and availability within the affected AVideo instance.

CVE-2026-126542: WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

How serious is successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

How serious is successful exploitation?