Reviactyl ist ein Open-Source-Spielserver-Management-Panel, das mit Laravel, React, FilamentPHP, Vite und Go erstellt wurde. Von Version 26.2.0-beta.1 bis vor Version 26.2.0-beta.5 erlaubte eine Schwachstelle im OAuth-Authentifizierungsablauf die automatische Verknüpfung von Social-Accounts basierend ausschließlich auf übereinstimmenden E-Mail-Adressen. Ein Angreifer konnte ein Social-Account (z.B. Google, GitHub, Discord) mit der E-Mail-Adresse eines Opfers erstellen oder kontrollieren und so vollen Zugriff auf das Konto des Opfers erhalten, ohne dessen Passwort zu kennen.

The impact of CVE-2026-34456 is severe due to the ease of exploitation and the potential for complete account takeover. An attacker only needs to control or create a social account associated with the victim's email address. Once linked, the attacker gains full administrative access to the Reviactyl panel, allowing them to modify game server settings, access player data, and potentially compromise the entire game server environment. This vulnerability could lead to data breaches, service disruptions, and unauthorized modifications to game configurations. The lack of password requirement significantly lowers the barrier to entry for attackers, making it a high-priority risk.

Game server administrators and users of Reviactyl are at risk, particularly those who rely on social account linking for authentication. Shared hosting environments where multiple users share the same domain are also at increased risk, as an attacker could potentially leverage this vulnerability to compromise multiple accounts.

• linux / server:

journalctl -u reviactyl | grep -i "social account linking"

• generic web:

curl -I https://your-reviactyl-instance/auth/social/callback | grep -i "email"

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-27
2. Veröffentlicht2026-04-01
3. Geändert2026-04-03
4. EPSS aktualisiert2026-04-09

The primary mitigation for CVE-2026-34456 is to immediately upgrade Reviactyl to version 26.2.0-beta.5 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider temporarily disabling social account linking within the Reviactyl configuration. While this will impact user convenience, it will prevent attackers from exploiting the vulnerability. Monitor Reviactyl logs for any suspicious account linking activity, particularly involving unfamiliar social accounts. Review and audit existing social account links to identify any potentially unauthorized connections. After upgrading, confirm the fix by attempting to link a social account using an email address you control and verifying that the linking process is blocked.