Authentication Bypass in WWBN AVideo 6.5 through 29.7.1 by Unauthenticated Attackers

CVE-2026-126542

What is CVE-2026-126542?

The authentication bypass vulnerability in AVideo versions 6.5 through 29.7.1 allows attackers to gain unauthorized access as any user, including administrative accounts. By manipulating their social login display names through Hybridauth, an attacker can misrepresent themselves as a victim by setting their social account's display name to that of a target user. With no requirement for a password, this exploit can occur via login.json.php or oauth2.php, leading to significant security risks for affected systems.

References