CVE-2026-86187

WWBN AVideo, an open-source self-hosted video platform, generates passwords for externally created login accounts using PHP's non-cryptographic rand() function, limiting each password to a 31-bit integer space of roughly two billion possibilities. Because these passwords are stored as unsalted MD5 hashes, an attacker who obtains the password-hash database — for example through a database compromise, a backup leak, or a separate vulnerability — can brute-force the plaintext passwords offline within minutes. Successful recovery exposes the credentials of external-login accounts, which attackers could use to access the platform or, if users reused those passwords, other services. Only AVideo deployments that provision accounts through the external-login feature are affected. Exploitation has not been observed: there is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

What to do: Inventory AVideo deployments and identify any accounts created via the external-login mechanism, since only those accounts use the weak rand()-generated passwords. No patched version or fixed release is specified in the available data, so monitor the vendor for an update; as interim mitigation, have administrators set strong, manually chosen passwords for external-login accounts and rotate them if the password-hash database may have been exposed. Treat stored MD5 hashes for these accounts as effectively recoverable plaintext if obtained.