WWBN AVideo: Authentication bypass via Hybridauth social login display names
Summary
WWBN AVideo versions 6.5 through 29.7.1 contain an authentication bypass in the Hybridauth social login. An unauthenticated attacker sets the display name of an X, Facebook, Yahoo or LinkedIn account to a victim's username and withholds the email address. The login then authenticates the attacker as that account, including administrator accounts, without a password.
Affected
- WWBN AVideo 6.5 through 29.7.1
- Default configuration: unaffected (per CVE record)
Fixed in
Unknown.
Workaround
- Disable social login (Hybridauth providers) if it is not required.
- Restrict access to the login and OAuth endpoints (objects/login.json.php, plugin/MobileManager/oauth2.php) at a reverse proxy or WAF until a fixed version is confirmed.
Exploitation
- No known exploitation at time of publication.
- No public proof of concept confirmed.
- The CVE record is marked as deferred at NVD; the status of the fix is not confirmed.
Our recommendation
- Check whether any AVideo instance is internet-facing and has social login enabled.
- Disable social login until the vendor's fixed version is confirmed and installed.
- Review administrator and user logins for unexpected sessions and reset administrator credentials if there is doubt.
- Monitor the GitHub advisory for the fixed version and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub: objects/login.json.php at v29.7.1 github.com
- GitHub: plugin/MobileManager/oauth2.php at v29.7.1 github.com
- GitHub commit d34ccf23b37a127a68478d66ac00b450b5788bad github.com
- GitHub Security Advisory GHSA-9rvm-cfc4-q9g9 github.com
- VulnCheck advisory: AVideo authentication bypass via Hybridauth social login www.vulncheck.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:20.
Original description (NVD)
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.
NVD references (6)
- https://github.com/WWBN/AVideo/blob/v29.7.1/objects/login.json.php#L133-L145
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/MobileManager/oauth2.php#L90-L102
- https://github.com/WWBN/AVideo/commit/d34ccf23b37a127a68478d66ac00b450b5788bad
- https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9
- https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-authentication-bypass-via-hybridauth-soci…
- https://github.com/WWBN/AVideo/security/advisories/GHSA-9rvm-cfc4-q9g9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.