CVE-2026-34456 - Vulnerability Analysis

Overview

Reviactyl 26.2.0-beta.1 to < 26.2.0-beta.5 contains an authentication bypass caused by automatic social account linking based on email matching, letting attackers take over accounts without prior authentication.

Severity & Score

Impact

Attackers can fully take over user accounts without knowing passwords, leading to complete account compromise.

Mitigation

Upgrade to version 26.2.0-beta.5 or later.

References

• https://github.com/reviactyl/panel/security/advisories/GHSA-8mcf-rp68-xhfg
• https://github.com/reviactyl/panel/commit/fe0c29fc62fefe354c9ab8936dfe30fdb586a896
• https://github.com/reviactyl/panel/releases/tag/v26.2.0-beta.5

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 2, 2026

🔴 CVE-2026-34456 - Critical (9.1) Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34456/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner