Skip to content
Threat Feed
Subscribe
high advisory

6amTech 6valley: Authorization bypass in Social Login Flow (CVE-2026-122019)

A vulnerability in the 6valley 16.0 Social Login Flow allows remote attackers to bypass authorization by manipulating the user_response argument during account verification.

CVE search metadata

CVE search record: CVE-2026-122019. Severity: high. CVSS: 7.3. KEV: no. Product: 6valley (16.0). Brief: 6amTech 6valley: Authorization bypass in Social Login Flow (CVE-2026-122019). Brief link: https://feed.craftedsignal.io/briefs/2026-11-6valley-auth-bypass/

Triage facts

Revision 1
Applicability
6valley (16.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 5, 00:07 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

A vulnerability (CVE-2026-122019) exists in the 6amTech 6valley version 16.0 component related to Social Login Flow. The flaw resides in the existingAccountCheck function within the /api/v1/auth/existing-account-check file. An unauthenticated remote attacker can manipulate the user_response parameter to bypass authorization checks. Publicly available exploit material exists for this vulnerability.

Impact

Successful exploitation allows remote attackers to bypass intended authorization controls, potentially leading to unauthorized account access.

Recommendation

  • Inventory all instances of 6valley 16.0 within the environment.
  • Patch the application immediately or apply configuration changes to restrict access to the /api/v1/auth/existing-account-check endpoint until an official fix is applied.
  • Review web server access logs for anomalous POST requests to the identified API endpoint containing suspicious values in the user_response parameter.

Immediate actions

Inventory 6valley 16.0 instances

IT Operations 24h

Threat Hunt

Hunt for suspicious parameter manipulation in user_response

T1190 high medium confidence hunt now

Data: Full request body or URI parameter logging for /api/v1/auth/existing-account-check

Mitigations

Disable or restrict access to the affected API endpoint

immediate IT Operations

CVE-2026-122019

Detection coverage 1

Detect CVE-2026-122019 Exploitation - Unauthorized Account Access via Social Login

high

Detects potential exploitation of the 6valley existingAccountCheck function by monitoring for calls to the authentication API endpoint.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →