Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the Reviactyl game server management panel allowed unauthorized account access by linking social accounts using only matching email addresses, potentially leading to full account takeovers. This issue affects specific beta versions of the software, and a patch is available.
- Attackers could take over accounts using just emails.
- It impacts account security for user data.
- Confirm if your Reviactyl instances are affected.
Attack Path
How an attacker could exploit the issue
An attacker can compromise user accounts by exploiting a flaw in the OAuth authentication process. By controlling a social media account linked to a victim's email address, an attacker can bypass normal login procedures and gain full control of the victim's Reviactyl account. This attack requires no prior authentication or knowledge of the victim's password.
- Requires attacker-controlled social account.
- Exploits email matching in OAuth flow.
- Results in full account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to gain full control of a user's account by exploiting a weakness in the OAuth authentication flow. When supported by the advisory, this could happen if an attacker can control a social account linked to a victim's email address, leading to an account takeover without needing the victim's password.
- User accounts on the game server management panel.
- Automatic linking of social accounts via email.
- Full account takeover.
Operational Fix
Recommended remediation, mitigation, and detection steps
Systems running Reviactyl game server management panels are likely managed by platform or application owners, with security teams responsible for broader exposure. The immediate priority is to locate all instances of the affected software, confirm their network reachability and business criticality, and identify the specific asset owner. Following this, a risk-based remediation plan, coordinated with vendor management if necessary, should be developed.
- Platform or application owners should address.
- Verify affected Reviactyl instances and reachability.
- Plan remediation based on confirmed risk.
