critical
CVE-2026-126542
AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting not bound to the site's merchant, Live restream stream-key IDOR, API tag access to restricted videos, and loose-comparison email verification bypass - NO fixed release yet
- Severity
- critical
- Affected product
- AVideo
- Affected versions
- AVideo ≤ 29.7.1
- Detection basis
- Component version range
- Shipped rule
- AVideo: AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting not bound to the site's merchant, Live restream stream-key IDOR, API tag access to restricted videos, and loose-comparison email verification bypass - NO fixed release yet
- Added to NewScan
- 2026-11-11
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints AVideo from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.