CVE-2026-92578

WWBN AVideo, a self-hosted open-source video streaming platform, accepts the stored users.password hash value itself as a valid login credential. Because two independent code paths — loginFromRequest() and encryptPasswordVerify() — verify a submitted credential by comparing it against the stored hash rather than the original password, an attacker who submits the hash directly to login endpoints authenticates as any user. Practical exploitation therefore requires the attacker to first obtain a user's stored hash, typically through a secondary flaw such as SQL injection, file exposure, or log leakage, which the CVSS 4.0 'AT:P' (attack requirements present) score component reflects. Any AVideo deployment running version 29.0 or earlier is affected, with internet-facing instances most at risk. No public proof-of-concept, inclusion in CISA KEV, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade AVideo to a release newer than 29.0 as soon as the vendor publishes a fix, and monitor the vendor's repository for the patched version. Until patched, prevent hash disclosure — remediate any SQL injection or file/log exposure issues, restrict access to login endpoints, and rotate passwords for accounts whose hashes may have leaked. Because the hash itself acts as a credential, treat any confirmed hash exposure as a full account compromise and review authentication logs for logins submitted with hash-like strings.