{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122019", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T14:35:35.233Z", "datePublished": "2026-11-04T21:45:07.639Z", "dateUpdated": "2026-11-04T21:45:07.639Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-04T21:45:07.639Z"}, "title": "6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "6amTech", "product": "6valley", "versions": [{"version": "16.0", "status": "affected"}], "cpes": ["cpe:2.3:a:6amtech:6valley:*:*:*:*:*:*:*:*"], "modules": ["Social Login Flow"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T15:40:40.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "havel8964 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/431085", "name": "VDB-431085 | 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431085/cti", "name": "VDB-431085 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122019", "name": "CVE-2026-122019 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1024992", "name": "Submit #1024992 | 6amTech 6valley 16.0 Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://github.com/oscar2744/CVE-Submit/issues/3", "tags": ["exploit", "issue-tracking"]}], "x_generator": ["VulDB PVTS v202611"]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:6amtech:6valley:*:*:*:*:*:*:*:*"], "modules": ["Social Login Flow"], "product": "6valley", "vendor": "6amTech", "versions": [{"status": "affected", "version": "16.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used."}], "id": "CVE-2026-122019", "lastModified": "2026-11-04T22:17:56.107", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2026-11-04T22:17:55.930", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/oscar2744/CVE-Submit/issues/3"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122019"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1024992"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431085"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431085/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{"bugzilla": {"description": "6valley: 6valley: Authorization bypass via manipulated user response in social login flow", "id": "2567880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567880"}, "csaw": false, "cwe": "CWE-807", "details": ["A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.", "A flaw was found in 6valley. A remote attacker can bypass authorization controls by submitting a manipulated user response parameter to the account check endpoint during the social login process. This vulnerability could allow an attacker to gain unauthorized access to user accounts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122019", "public_date": "2026-11-04T21:45:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122019\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122019\nhttps://github.com/oscar2744/CVE-Submit/issues/3\nhttps://vuldb.com/cve/CVE-2026-122019\nhttps://vuldb.com/submit/1024992\nhttps://vuldb.com/vuln/431085\nhttps://vuldb.com/vuln/431085/cti"], "statement": "This vulnerability is rated Important due to the ability of an unauthenticated remote attacker to bypass identity checks and gain unauthorized access to accounts without user interaction. However, 6valley is not packaged, shipped, or supported in any Red Hat enterprise products. As a result, default Red Hat deployments are unaffected by this vulnerability.", "threat_severity": "Important"}