Reviactyl OAuth Account Takeover (CVE-2026-34456)

Overview

A critical authentication flaw has been identified in the open-source Reviactyl game server management panel. The vulnerability, tracked as CVE-2026-34456, exists in the OAuth account linking logic. It allows an attacker to take over any user account without needing a password.

Vulnerability Details

In affected versions (from 26.2.0-beta.1 to before 26.2.0-beta.5), the application’s OAuth flow automatically links a new social login provider (like Google or GitHub) to an existing local user account if the email addresses match. This process occurs without requiring any confirmation from the legitimate account holder.

An attacker can exploit this by creating a social media account using the victim’s email address. When the attacker logs into Reviactyl with this malicious social account, the system automatically grants them full access to the victim’s existing Reviactyl account. No prior authentication or knowledge of the victim’s password is required.

Impact and Risk

The impact is severe and straightforward: complete account takeover. An attacker gaining access to an administrator’s account could seize control of managed game servers, deploy malicious software, steal sensitive data, or disrupt services. The attack complexity is low, requires no user interaction, and can be performed remotely, leading to its high CVSS score of 9.1.

Remediation and Mitigation

The primary and only complete remediation is to upgrade Reviactyl to version 26.2.0-beta.5 or later, where this logic flaw has been patched.

Immediate Actions:

1. Update Immediately: All users running Reviactyl versions 26.2.0-beta.1 through 26.2.0-beta.4 must upgrade to 26.2.0-beta.5 without delay.
2. Audit Accounts: Review administrator and user accounts for any unrecognized OAuth provider links or suspicious activity.
3. Monitor Logs: Closely monitor authentication logs for unexpected OAuth login attempts, particularly those associated with account linking events.

Until the patch is applied, consider temporarily disabling OAuth-based logins if this feature is not essential for your operations.

Security Insight

This vulnerability highlights the inherent risk in automating trust based on a single, unverified attribute like an email address. It mirrors the logic flaw seen in the GlassWorm attack, where automated systems were abused for unauthorized access. For projects like Reviactyl that integrate multiple complex frameworks (Laravel, React, Go), this underscores the critical need for security-focused integration testing, especially around third-party authentication flows which are a frequent source of architectural flaws.

Further Reading

• Google Adds 24-Hour Wait for Unverified App Sideloading t…
• DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for F…
• GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push…
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs