Read the docs
TI-2026-85230 Aliases CVE-2026-122019GHSA-v664-wmf2-px79

Authorization bypass in 6amTech 6valley Social Login Flow

Priority LOW 30CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

6amTech 6valley version 16.0 is affected. A flaw in the existingAccountCheck function of the Social Login Flow component lets attackers bypass authorization by manipulating the user_response argument (CWE-285). A remote attacker with no privileges and no user interaction can exploit this. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used.

Why it matters now

EPSS 0.00292 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
6amTech6valley16.0—No fix listedCNA
  • 6valley Vendor6amTech Affected 16.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:6amtech:6valley:*:*:*:*:*:*:*:*——6amTech
  • cpe:2.3:a:6amtech:6valley:*:*:*:*:*:*:*:* Versions — — ·6amTech

Remediation

The sources list no fixed version for 6amTech 6valley.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122019
  2. 2026-11-05 Alias added: GHSA-v664-wmf2-px79
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences