CVE-2026-122019

Deferred Deferred - Pending Action

Authorization Bypass in 6amTech 6valley via Social Login

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulDB

Description

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-122019

Affected Vendors & Products

Vendor	Product	Version / Range
6amTech	6valley	16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in 6amTech 6valley 16.0. It exists in the Social Login Flow component, specifically in the function existingAccountCheck of the file /api/v1/auth/existing-account-check. The issue arises from improper handling of the user_response argument, allowing attackers to bypass authorization checks remotely.

Impact Analysis

This vulnerability allows remote attackers to bypass authorization mechanisms, potentially gaining unauthorized access to sensitive data or functions. Since the exploit is publicly available, the risk of exploitation is higher. Users of 6amTech 6valley 16.0 should apply patches immediately to mitigate this risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations using the affected software may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Immediately update the 6amTech 6valley software to the latest patched version. Disable the Social Login Flow component if not in use. Monitor network traffic for unauthorized access attempts targeting the /api/v1/auth/existing-account-check endpoint.

Hi! I’m here to help you understand CVE-2026-122019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...