CVE-2026-122019

Name of the Vulnerable Software and Affected Versions 6amTech 6valley version 16.0

Description An authorization bypass exists in the Social Login Flow component. A remote attacker can manipulate the user response variable within the existingAccountCheck() function at the '/api/v1/auth/existing-account-check' endpoint to bypass authentication mechanisms.

Recommendations As a temporary workaround, restrict access to the '/api/v1/auth/existing-account-check' endpoint or avoid using the user response parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.