CVE-2026-86723

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authentication flaw in LoginControl::verifyChallenge(), where a loose PHP comparison (==) is used instead of a strict comparison (===) when checking the PGP two-factor challenge against session values. An attacker who already knows a user's password can send an empty request to verifyChallenge.json.php, causing the unset session values to loosely match and the second-factor challenge to be treated as verified. This grants full authenticated access to the affected account without possession of the PGP second factor, effectively disabling two-factor protection for that login. Any AVideo deployment that relies on PGP-based two-factor authentication is affected, especially self-hosted video portals with the login endpoint reachable from the internet; note the attacker must already hold the account password. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Update AVideo to a revision newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 (current release/master), since no fixed version number is stated in the available data. Until patched, do not treat PGP two-factor as a strong control for high-value accounts on affected installs: enforce strong, unique passwords, restrict network access to verifyChallenge.json.php where feasible, and review authentication logs for empty requests to that endpoint followed by successful logins on PGP-2FA-enabled accounts.