{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34456", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T18:18:14.895Z", "datePublished": "2026-04-01T20:00:55.743Z", "dateUpdated": "2026-04-02T14:17:01.180Z"}, "containers": {"cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}, {"name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"version": ">= 26.2.0-beta.1, < 26.2.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}, "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T14:16:51.333124Z", "id": "CVE-2026-34456", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:17:01.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34456", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:16:51.333124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:16:55.829Z"}}], "cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"status": "affected", "version": ">= 26.2.0-beta.1, < 26.2.0-beta.5"}]}], "references": [{"url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34456", "state": "PUBLISHED", "dateUpdated": "2026-04-02T14:17:01.180Z", "dateReserved": "2026-03-27T18:18:14.895Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T20:00:55.743Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "F8D3FEB3-9EB8-4856-8B4B-C729D5DC1DC4", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "E82FD16F-ED7D-4C6C-A039-F3A4F418BCFC", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "D2FE3906-FD27-43A5-8012-7A61FC395D3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "C12D8410-5633-4819-9EAF-B7A08351F540", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "id": "CVE-2026-34456", "lastModified": "2026-04-15T14:25:47.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-01T20:16:26.120", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.2.0-beta.1,26.2.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "panel", "source": "cna", "vendor": "reviactyl"}, "product": "panel", "vendor": "reviactyl"}], "analysis": {"en": {"generated_at": "2026-04-15T22:37:17.449131+00:00", "value": {"mitigation_remediation": ["Update the Reviactyl panel to version 26.2.0\u2011beta.5 or later which contains the patch for the OAuth auto\u2011linking flaw.", "If an immediate upgrade is not possible, disable automatic linking of social accounts or remove OAuth integration until the patch is applied to prevent unintended account takeovers.", "Audit existing user accounts for suspicious social account link logs and consider revoking compromised accounts.", "Monitor authentication logs for abnormal social account linking events and implement alerts for rapid incident response."], "summary": {"action": "Patch immediately", "impact": "Full account takeover via auto\u2011linking of social accounts"}, "threat_synthesis": {"affected_systems": "The affected system is the Reviactyl panel, an open\u2011source game server management interface. Vulnerable releases span from 26.2.0\u2011beta.1 through 26.2.0\u2011beta.4 inclusive. Versions starting at 26.2.0\u2011beta.5 contain the patch that closes the auto\u2011linking flaw.", "description_and_impact": "Reviactyl panels from version 26.2.0\u2011beta.1 up to but not including 26.2.0\u2011beta.5 contain an OAuth authentication flaw that automatically links a social account to a local user account solely when the email addresses match. The flaw allows an attacker to create or control a social account with a victim\u2019s email address and obtain complete access to the victim\u2019s account without ever having to know the user\u2019s password. This is a classic account takeover scenario and represents a serious breach of authentication policy. The weakness is classified as improper authorization (CWE\u2011284) and noted as a missing\u2011information identifier (NVD\u2011CWE\u2011noinfo).", "risk_and_exploitability": "The CVSS score is 9.1, indicating a critically severe vulnerability. The EPSS score is < 1% (approximately 0.0008), reflecting a very low exploitation probability, but this does not diminish the high severity of the flaw. Because the attack requires only the victim\u2019s email address and no password, the threat of exploitation remains high if an adversary can obtain or control a social account with that address. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited remotely from any internet\u2011connected location by creating a malicious social account and letting it auto\u2011link to a victim\u2019s local account."}}}}, "created": "2026-04-02T07:47:54.031681+00:00", "updated": "2026-04-15T22:45:16.435676+00:00", "vendors": ["reviactyl", "reviactyl$PRODUCT$panel"]}