A critical security flaw in the open-source video platform AVideo lets an attacker sign in as any user on a vulnerable site, including administrators, without knowing a password. The vulnerability, tracked as CVE-2026-126542, was published on 11 November 2026 and affects AVideo versions 6.5 through 29.7.1. Site owners are advised to update or switch off the affected social login feature.

How the flaw works

The weakness sits in AVideo's social login handling, which uses the Hybridauth library to let people sign in through providers such as X, Facebook, Yahoo and LinkedIn. According to the CVE record, the login endpoints login.json.php and oauth2.php accept a display name supplied by the identity provider without properly checking that an email address has been verified.

An attacker can set their display name on the social provider to match a victim's username, for example "admin", and leave out the email field. The AVideo code then trusts that profile data and starts a fully authenticated session as that account. No password, token or prior access is needed, and the attack can be carried out over the network.

Severity and scope

The flaw is rated 9.8 out of 10 under CVSS 3.1 and 9.3 under CVSS 4.0, placing it in the critical band. It is classed as CWE-290, authentication bypass by spoofing. Because any account can be taken over, including administrator accounts, a successful attack could give an intruder full control of the video site, its content and its user data.

AVideo is a self-hosted video sharing and streaming platform, so the number of affected sites depends on how many operators run versions in the affected range with social login switched on. The vendor has published a security advisory, GHSA-9rvm-cfc4-q9g9, and a patch commit for the issue.

What site owners should do

The recommended fix is to upgrade AVideo to a version above 29.7.1. The CVE record itself does not name a fixed version, so operators should check the vendor's advisory and release notes for the corrected build. If an upgrade cannot be applied at once, the social login feature should be disabled until it can be, for example by restricting access to the HybridAuth plugin.

Operators should also review their login logs for unusual sign-ins through the social login endpoints, check for unexpected administrator accounts or changes, and reset administrator credentials as a precaution. There is no confirmed report of the flaw being exploited in the wild at the time of publication.