6valley social login account check allows authorization bypass
Attackers can slip past login checks and enter other accounts on the 6valley web program.
Summary
The account check in the social login flow of 6valley 16.0 can be bypassed by manipulating a request, skipping authorization checks. It can be attacked remotely, and public exploit code exists.
Affected when
- Social login feature in use
What to do
No fixed version is named in the sources. Check that you run a version newer than 16.0 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
Times
First published
First seen