CVE-2026-86722

AVideo, an open-source self-hosted video streaming platform, contains an authentication bypass in its email-based two-factor authentication. The flaw stems from the sqlDAL data-access layer caching empty database result sets that the writeSql function never invalidates, so when a login from a new device is processed, the email 2FA confirmation code hash fails to generate from the stale cached empty result. An attacker who already possesses a user's valid password can therefore complete login from a new device and skip the email 2FA challenge, gaining full access to that account. Any AVideo deployment through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected, with the greatest impact on sites that enable email 2FA for new-device logins. There is no public proof-of-concept, the EPSS score is low (0.3%), and the flaw is not yet listed in CISA's KEV, indicating no known exploitation.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, per upstream guidance, so the stale empty-result caching in sqlDAL is corrected. Where patching is not immediately possible, disable or supplement email-based 2FA with a stronger second factor and ensure account passwords are strong, since exploitation requires a valid password. Defenders should also review authentication logs for logins from unrecognized devices.