Google CVE-2026-34456

Reviactyl is an open-source game server management panel built on Laravel (PHP framework) with React frontend, FilamentPHP admin interface, Vite build tooling, and Go backend components. The vulnerability stems from improper access control (CWE-284) in the OAuth social authentication integration flow. The panel's OAuth implementation automatically linked external identity provider accounts (Google, GitHub, Discord) to existing Reviactyl user accounts based solely on email address matching, without verifying email ownership or requiring existing authentication. Because OAuth providers do not universally verify email ownership during account creation, an attacker could register a social account at a provider using a victim's email address (even if the attacker cannot access that email inbox), then authenticate to Reviactyl via OAuth. The system would treat the matching email as sufficient proof of identity and grant access to the existing account. This violates secure OAuth implementation patterns, which require either email verification or explicit user consent before account linking, particularly when the email address has not been verified by the OAuth provider.