CVE-2026-122019
Description
A flaw was found in 6valley. A remote attacker can bypass authorization controls by submitting a manipulated user response parameter to the account check endpoint during the social login process. This vulnerability could allow an attacker to gain unauthorized access to user accounts.
Statement
This vulnerability is rated Important due to the ability of an unauthenticated remote attacker to bypass identity checks and gain unauthorized access to accounts without user interaction. However, 6valley is not packaged, shipped, or supported in any Red Hat enterprise products. As a result, default Red Hat deployments are unaffected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
