CVE-2026-34456 is a critical (CVSS 9.1) account takeover flaw in Reviactyl, the game server management panel. The OAuth flow linked social accounts by matching email address alone. The fix is version 26.2.0-beta.5, and disabling OAuth providers reduces exposure until then.
What's affected
The project's advisory (GHSA-8mcf-rp68-xhfg) and the NVD record cover the Composer package reviactyl/panel from 26.2.0-beta.1 to before 26.2.0-beta.5. The patched release is 26.2.0-beta.5.
In the vulnerable versions, signing in with a social account (the advisory names Google, GitHub and Discord) automatically linked to the existing panel account with the same email. Someone who could create or control a social account using a victim's email address could reach the victim's panel account without the password.
How to check if you're exposed
composer show reviactyl/panel
Or read the version from the panel footer. Also check the list of enabled OAuth providers in the settings. If none are enabled, the vulnerable path is closed, which is the advisory's temporary mitigation.
Look at the audit or login logs for OAuth sign-ins to admin accounts that the owners did not make.
Check how the app reads the provider's email claim and whether it asks the provider if the address is verified. If you maintain your own login code, review the same question there.
What to do now
- Upgrade to 26.2.0-beta.5 or the latest 26.x release.
- Until then, disable all OAuth login providers.
- Review admin and user accounts for new linked social identities you do not recognize.
- Reset passwords and sessions for any account with suspicious sign-ins.
- Enable two-factor authentication for administrators.
Why it matters
The weakness is CWE-284, improper access control. Linking by email address trusts a claim the identity provider may not have verified, or that an attacker can set up. An email on a social profile is a label, not proof the person owns the panel account.
Safer designs require the user to sign in to the existing account first, then link the social identity, or they link only when the provider asserts a verified email and the app has confirmed the match. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
After the upgrade, consider forcing users to confirm linked social accounts again, or at least review the list of linked identities for admins. Two-factor authentication on the panel adds protection that does not depend on the provider.
For operators of game hosting panels, the stakes include more than the panel. An account takeover on a hosting panel can mean control over servers, files and billing details tied to the account. After you upgrade, review recent changes to server settings and scheduled tasks on admin and high-value accounts. If the panel offers API keys, rotate the ones belonging to accounts that signed in through a social provider during the exposure window. Document the change for your users, so they know that linking a social login now needs an extra step if you add one.
Quick check
Does disabling OAuth fully fix it?
It reduces exposure, per the advisory, but the fix is the upgrade.
Sources
Last reviewed: 19 October 2026.
