AVideo Authentication Bypass Lets Attackers Log In as Any User

WWBN AVideo versions 6.5 through 29.7.1 contain an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user.

Attackers can set their X, Facebook, Yahoo, or LinkedIn display name to a victim's username and withhold email. This causes login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

• Affected versions: 6.5 through 29.7.1
• No password required
• Administrator accounts can be targeted