CVE-2026-34456 Reviactyl: OAuth account takeover via auto-linking
Attackers can take over user accounts by linking social profiles with matching emails, bypassing password authentication in Reviactyl.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34456?
CVE-2026-34456 is a critical authentication bypass vulnerability in reviactyl panel, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim’s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5.
Weakness: CWE-284
Which versions are affected by CVE-2026-34456?
It affects 1 product.
Products include Reviactyl Reviactyl.
How do I fix CVE-2026-34456?
No fix has been published for CVE-2026-34456 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-34456 being exploited?
There is no known exploitation of CVE-2026-34456 in the wild and no public exploit code.
Sources
Also known as GHSA-8mcf-rp68-xhfg.