Anyone Can Log In as Your Admin: AVideo CVE-2026-126542 Explained

What this session covers

A video site that runs AVideo 29.7.1 with “Sign in with X” or Facebook login switched on was a normal setup until this week. CVE-2026-126542 is an authentication bypass in the social login of WWBN AVideo, the open-source video platform. When the login provider returns a profile without an email address, the vulnerable code uses the display name as the local username. The display name is chosen by whoever signs in, so if it matches an existing account, such as admin, the code signs in to that account without a password check. It affects every release from 6.5 up to 29.7.1. The fix is commit d34ccf2 of 9 November 2026; at the time of recording no tagged release contains it yet.

We rebuild the situation in our isolated lab, with the real code at both versions, and go through the response in five steps: check exposure, read the public fix, look for signs that an account was already taken over, switch off the affected providers to buy time, and patch and prove the fix is in the code. We close with a checklist you can run today.

Key takeaways

• Two conditions, both required. The code must be the old version, and at least one of the X, Facebook, Yahoo or LinkedIn login plugins must be active.
• The fix is easy to verify. After updating, objects/login.json.php and plugin/MobileManager/oauth2.php both call getSocialLoginUserId; the old display-name fallback is gone.
• Look for traces first. Search the web logs for login.json.php?type= callbacks and check accounts without an email that were recently marked as verified, administrators first. A match is not proof, but it is a strong reason to treat the account as compromised.
• Switching providers off is a stopgap. Disabling the affected login plugins closes the path while email and password login keeps working, but the fix is still to update.
• No release yet. Update to the latest master, or to the first release after 29.7.1 once it ships, then confirm the fix in the code.

About the lab

Everything in the video runs in an isolated lab with no internet access. The exploit itself is not shown or discussed in reproducible detail; this is a defensive walkthrough only. Account names, addresses and log lines are invented lab data. The commands shown are standard read-only administration checks that you can run on your own server.