{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34456", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T18:18:14.895Z", "datePublished": "2026-04-01T20:00:55.743Z", "dateUpdated": "2026-04-02T14:17:01.180Z"}, "containers": {"cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}, {"name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"version": ">= 26.2.0-beta.1, < 26.2.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}, "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T14:16:51.333124Z", "id": "CVE-2026-34456", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:17:01.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34456", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:16:51.333124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T14:16:55.829Z"}}], "cna": {"title": "Reviactyl: OAuth account takeover via auto-linking", "source": {"advisory": "GHSA-8mcf-rp68-xhfg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "reviactyl", "product": "panel", "versions": [{"status": "affected", "version": ">= 26.2.0-beta.1, < 26.2.0-beta.5"}]}], "references": [{"url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "name": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "name": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "name": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T20:00:55.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34456", "state": "PUBLISHED", "dateUpdated": "2026-04-02T14:17:01.180Z", "dateReserved": "2026-03-27T18:18:14.895Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T20:00:55.743Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}], "id": "CVE-2026-34456", "lastModified": "2026-04-01T20:16:26.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-01T20:16:26.120", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896"}, {"source": "security-advisories@github.com", "url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.2.0-beta.1,26.2.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "panel", "source": "cna", "vendor": "reviactyl"}, "product": "panel", "vendor": "reviactyl"}], "analysis": {"en": {"generated_at": "2026-04-02T03:44:10.652886+00:00", "value": {"mitigation_remediation": ["Update the Reviactyl panel to version 26.2.0\u2011beta.5 or later which contains the patch for the OAuth auto\u2011linking flaw."], "summary": {"action": "Patch immediately", "impact": "Full account takeover via auto\u2011linking of social accounts"}, "threat_synthesis": {"affected_systems": "The affected system is the Reviactyl panel, an open\u2011source game server management interface. Vulnerable releases span from 26.2.0\u2011beta.1 through 26.2.0\u2011beta.4 inclusive. Versions starting at 26.2.0\u2011beta.5 contain the patch that closes the auto\u2011linking flaw.", "description_and_impact": "Reviactyl panels from version 26.2.0\u2011beta.1 up to but not including 26.2.0\u2011beta.5 contain an OAuth authentication flaw that automatically links a social account to a local user account solely when the email addresses match. The flaw allows an attacker to create or control a social account with a victim\u2019s email address and obtain complete access to the victim\u2019s account without ever having to know the user\u2019s password. This is a classic account takeover scenario and represents a serious breach of authentication policy. The weakness is classified as improper authorization (CWE\u2011284).", "risk_and_exploitability": "The CVSS score is 9.1, indicating a critically severe vulnerability. While the EPSS score is not published, the lack of a required password, the need for only an email address, and the ubiquity of OAuth providers suggest a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it poses a remote exploitation risk that can be carried out from any internet\u2011connected location by simply creating a malicious social account. Attackers need only the victim\u2019s email; no other prior authorization is required."}}}}, "created": "2026-04-02T07:47:54.031681+00:00", "updated": "2026-04-02T20:16:47.273341+00:00", "vendors": ["reviactyl", "reviactyl$PRODUCT$panel"]}