CVE-2026-92578

HIGHCVSS 8.1

Description

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

Timeline

Published:September 16th, 2026 10:18 PM

Last modified:September 22nd, 2026 8:43 PM

CVSS Scoring

CVSS v3: 8.1 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

References & Reports

Advisories, patches, and third-party reports

https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-authentication-bypass-via-stored-password-hash
https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx

Source: NIST NVD · Data may lag official sources by up to one minute