CVE-2026-85154

WWBN AVideo, a self-hosted video publishing and streaming platform, treats the video_id_hash credential as a non-expiring, non-revocable bearer token that authenticates the holder as the video's owner. An attacker who obtains any user's video_id_hash can replay it indefinitely to obtain a fully privileged administrator session as that account, and the token continues to work even after the owner changes their password. The flaw (CWE-269, improper privilege management) is rated critical at CVSS 4.0 9.3 with network exploitability and no privileges or user interaction required, and affects WWBN AVideo deployments; no affected or fixed version ranges were specified in the available data. Exploitation has not been observed: there is no known public proof of concept, the issue is not in CISA's KEV, and EPSS estimates only about a 0.3% chance of exploitation within 30 days.

What to do: Update AVideo to the version that fixes CVE-2026-85154 as soon as the vendor publishes it, since no fixed version is specified in the available data. Until patched, treat every video_id_hash as a permanent credential: avoid exposing hashes in shared or logged URLs, regenerate hashes for sensitive accounts, and remember that changing a password does not invalidate the token. On internet-exposed servers, review logs for administrative sessions established using only a video hash.