CVE-2026-34456

{"id": "CVE-2026-34456", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34456", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T14:16:51.333124Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "reviactyl", "product": "panel", "versions": [{"status": "affected", "version": ">= 26.2.0-beta.1, < 26.2.0-beta.5"}]}]}], "published": "2026-04-01T20:16:26.120", "references": [{"url": "https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking of social accounts based solely on matching email addresses. An attacker could create or control a social account (e.g., Google, GitHub, Discord) using a victim\u2019s email address and gain full access to the victim's account without knowing their password. This results in a full account takeover with no prior authentication required. This issue has been patched in version 26.2.0-beta.5."}, {"lang": "es", "value": "Reviactyl es un panel de gesti\u00f3n de servidor de juegos de c\u00f3digo abierto construido usando Laravel, React, FilamentPHP, Vite y Go. Desde la versi\u00f3n 26.2.0-beta.1 hasta antes de la versi\u00f3n 26.2.0-beta.5, una vulnerabilidad en el flujo de autenticaci\u00f3n OAuth permit\u00eda la vinculaci\u00f3n autom\u00e1tica de cuentas sociales basada \u00fanicamente en la coincidencia de direcciones de correo electr\u00f3nico. Un atacante pod\u00eda crear o controlar una cuenta social (p. ej., Google, GitHub, Discord) usando la direcci\u00f3n de correo electr\u00f3nico de una v\u00edctima y obtener acceso total a la cuenta de la v\u00edctima sin conocer su contrase\u00f1a. Esto resulta en una toma de control total de la cuenta sin requerir autenticaci\u00f3n previa. Este problema ha sido parcheado en la versi\u00f3n 26.2.0-beta.5."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8D3FEB3-9EB8-4856-8B4B-C729D5DC1DC4"}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E82FD16F-ED7D-4C6C-A039-F3A4F418BCFC"}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2FE3906-FD27-43A5-8012-7A61FC395D3A"}, {"criteria": "cpe:2.3:a:reviactyl:reviactyl:26.2.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C12D8410-5633-4819-9EAF-B7A08351F540"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}