CVE-2026-34456

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34456", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T18:18:14.895Z", "datePublished": "2026-04-01T20:00:55.743Z", "dateUpdated": "2026-04-02T14:17:01.180Z"}, "containers": {"cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}, {"name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"version": ">= 26.2.0-beta.1, < 26.2.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}, "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T14:16:51.333124Z", "id": "CVE-2026-34456", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:17:01.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34456", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:16:51.333124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:16:55.829Z"}}], "cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"status": "affected", "version": ">= 26.2.0-beta.1, < 26.2.0-beta.5"}]}], "references": [{"url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34456", "state": "PUBLISHED", "dateUpdated": "2026-04-02T14:17:01.180Z", "dateReserved": "2026-03-27T18:18:14.895Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T20:00:55.743Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "panel", "vendor": "reviactyl", "versions": [{"status": "affected", "version": ">= 26.2.0-beta.1, < 26.2.0-beta.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "F8D3FEB3-9EB8-4856-8B4B-C729D5DC1DC4", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "E82FD16F-ED7D-4C6C-A039-F3A4F418BCFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "D2FE3906-FD27-43A5-8012-7A61FC395D3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "C12D8410-5633-4819-9EAF-B7A08351F540", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}, {"lang": "es", "value": "Reviactyl es un panel de gesti\u00f3n de servidor de juegos de c\u00f3digo abierto construido usando Laravel, React, FilamentPHP, Vite y Go. Desde la versi\u00f3n 26.2.0-beta.1 hasta antes de la versi\u00f3n 26.2.0-beta.5, una vulnerabilidad en el flujo de autenticaci\u00f3n OAuth permit\u00eda la vinculaci\u00f3n autom\u00e1tica de cuentas sociales basada \u00fanicamente en la coincidencia de direcciones de correo electr\u00f3nico. Un atacante pod\u00eda crear o controlar una cuenta social (p. ej., Google, GitHub, Discord) usando la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima y obtener acceso total a la cuenta de la v\u00edctima sin conocer su contrase\u00f1a. Esto resulta en una toma de control total de la cuenta sin requerir autenticaci\u00f3n previa. Este problema ha sido parcheado en la versi\u00f3n 26.2.0-beta.5."}], "id": "CVE-2026-34456", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34456", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T14:16:51.333124Z", "version": "2.0.3"}}]}, "published": "2026-04-01T20:16:26.120", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.2.0-beta.1,26.2.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "panel", "source": "cna", "vendor": "reviactyl"}, "product": "panel", "vendor": "reviactyl"}], "analysis": {"en": {"generated_at": "2026-04-15T22:37:17.449131+00:00", "value": {"mitigation_remediation": ["Update the Reviactyl panel to version 26.2.0\u2011beta.5 or later which contains the patch for the OAuth auto\u2011linking flaw.", "If an immediate upgrade is not possible, disable automatic linking of social accounts or remove OAuth integration until the patch is applied to prevent unintended account takeovers.", "Audit existing user accounts for suspicious social account link logs and consider revoking compromised accounts.", "Monitor authentication logs for abnormal social account linking events and implement alerts for rapid incident response."], "summary": {"action": "Patch immediately", "impact": "Full account takeover via auto\u2011linking of social accounts"}, "threat_synthesis": {"affected_systems": "The affected system is the Reviactyl panel, an open\u2011source game server management interface. Vulnerable releases span from 26.2.0\u2011beta.1 through 26.2.0\u2011beta.4 inclusive. Versions starting at 26.2.0\u2011beta.5 contain the patch that closes the auto\u2011linking flaw.", "description_and_impact": "Reviactyl panels from version 26.2.0\u2011beta.1 up to but not including 26.2.0\u2011beta.5 contain an OAuth authentication flaw that automatically links a social account to a local user account solely when the email addresses match. The flaw allows an attacker to create or control a social account with a victim\u2019s email address and obtain complete access to the victim\u2019s account without ever having to know the user\u2019s password. This is a classic account takeover scenario and represents a serious breach of authentication policy. The weakness is classified as improper authorization (CWE\u2011284) and noted as a missing\u2011information identifier (NVD\u2011CWE\u2011noinfo).", "risk_and_exploitability": "The CVSS score is 9.1, indicating a critically severe vulnerability. The EPSS score is < 1% (approximately 0.0008), reflecting a very low exploitation probability, but this does not diminish the high severity of the flaw. Because the attack requires only the victim\u2019s email address and no password, the threat of exploitation remains high if an adversary can obtain or control a social account with that address. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited remotely from any internet\u2011connected location by creating a malicious social account and letting it auto\u2011link to a victim\u2019s local account."}}}}, "created": "2026-04-02T07:47:54.031681+00:00", "updated": "2026-04-15T22:45:16.435676+00:00", "vendors": ["reviactyl", "reviactyl$PRODUCT$panel"]}