Reviactyl panels from version 26.2.0‑beta.1 up to but not including 26.2.0‑beta.5 contain an OAuth authentication flaw that automatically links a social account to a local user account solely when the email addresses match. The flaw allows an attacker to create or control a social account with a victim’s email address and obtain complete access to the victim’s account without ever having to know the user’s password. This is a classic account takeover scenario and represents a serious breach of authentication policy. The weakness is classified as improper authorization (CWE‑284) and noted as a missing‑information identifier (NVD‑CWE‑noinfo).

The affected system is the Reviactyl panel, an open‑source game server management interface. Vulnerable releases span from 26.2.0‑beta.1 through 26.2.0‑beta.4 inclusive. Versions starting at 26.2.0‑beta.5 contain the patch that closes the auto‑linking flaw.

The CVSS score is 9.1, indicating a critically severe vulnerability. The EPSS score is < 1% (approximately 0.0008), reflecting a very low exploitation probability, but this does not diminish the high severity of the flaw. Because the attack requires only the victim’s email address and no password, the threat of exploitation remains high if an adversary can obtain or control a social account with that address. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited remotely from any internet‑connected location by creating a malicious social account and letting it auto‑link to a victim’s local account.