WWBN AVideo: Authentication bypass via Hybridauth social login (CVE-2026-126542)

WWBN AVideo contains an authentication bypass vulnerability in its implementation of the Hybridauth library. An attacker can exploit this by setting their display name on supported social platforms (X, Facebook, Yahoo, or LinkedIn) to match an existing victim's username on the target AVideo instance. By withholding the email address during the OAuth flow, the application incorrectly trusts the social display name, allowing the attacker to authenticate as the target user, including accounts with administrative privileges, without requiring a password.

Impact

Unauthenticated attackers can achieve full account takeover of any user on the platform. If an administrator's username is known, the attacker can gain full administrative access to the AVideo instance.

Recommendation

• Immediately update AVideo to a version beyond 29.7.1 that includes the security fix for Hybridauth integration.
• Review authentication logs for suspicious logins, specifically identifying successful logins originating from OAuth endpoints (login.json.php or oauth2.php) that show unusual patterns or unexpected user account associations.
• Temporarily disable social login functionality if an immediate update cannot be performed.