{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/avideo-6.5---29.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-126542"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AVideo (6.5 - 29.7.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WWBN"],"content_html":"\u003cp\u003eWWBN AVideo contains an authentication bypass vulnerability in its implementation of the Hybridauth library. An attacker can exploit this by setting their display name on supported social platforms (X, Facebook, Yahoo, or LinkedIn) to match an existing victim's username on the target AVideo instance. By withholding the email address during the OAuth flow, the application incorrectly trusts the social display name, allowing the attacker to authenticate as the target user, including accounts with administrative privileges, without requiring a password.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthenticated attackers can achieve full account takeover of any user on the platform. If an administrator's username is known, the attacker can gain full administrative access to the AVideo instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update AVideo to a version beyond 29.7.1 that includes the security fix for Hybridauth integration.\u003c/li\u003e\n\u003cli\u003eReview authentication logs for suspicious logins, specifically identifying successful logins originating from OAuth endpoints (\u003ccode\u003elogin.json.php\u003c/code\u003e or \u003ccode\u003eoauth2.php\u003c/code\u003e) that show unusual patterns or unexpected user account associations.\u003c/li\u003e\n\u003cli\u003eTemporarily disable social login functionality if an immediate update cannot be performed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:09:05Z","date_published":"2026-11-11T02:09:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-auth-bypass/","summary":"WWBN AVideo versions 6.5 through 29.7.1 contain an authentication bypass vulnerability allowing unauthenticated attackers to impersonate any user, including administrators, by manipulating social login display names.","title":"WWBN AVideo: Authentication bypass via Hybridauth social login (CVE-2026-126542)","url":"https://feed.craftedsignal.io/briefs/2026-11-wwbn-avideo-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - AVideo (6.5 - 29.7.1)","version":"https://jsonfeed.org/version/1.1"}