CVE-2026-84483 in AVideo
Summary
by MITRE • 09/02/2026
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in WWBN AVideo prior to commit 9c39d8c8 represents a critical authentication bypass rooted in flawed cryptographic implementation within the encryptPass.json.php endpoint. This flaw allows unauthenticated actors to interact with the application's password hashing mechanism without valid credentials, effectively neutralizing one of the primary layers of defense against unauthorized access. The core technical deficiency lies in the method used to generate HMAC tokens for password encryption. Instead of utilizing a secret key known only to the server or derived from secure session data, the system employs the public site URL as the cryptographic key. Since this value is inherently public and static across instances of the software, it provides attackers with all necessary parameters required to replicate the authentication logic locally.
From an operational perspective, this flaw enables a sophisticated offline precomputation attack vector often referred to as rainbow table generation or hash cracking at scale. By leveraging the known site URL and the current timestamp, which is easily obtainable through standard HTTP requests, an attacker can compute valid HMAC tokens for any arbitrary password input submitted by them. This capability allows the system to return encrypted hashes that are mathematically consistent with those stored in the database. Consequently, if an attacker has obtained a copy of the user password database, they do not need to guess passwords against the live application where rate limiting or account lockout mechanisms might apply. Instead, they can perform high-speed offline brute-force attacks using powerful hardware accelerators such as GPUs or ASICs to reverse-engineer plaintext credentials from the stolen hashes with significantly higher efficiency and lower risk of detection.
This vulnerability aligns closely with CWE-287 Improper Authentication, specifically regarding the failure to properly verify identity before granting access or processing sensitive cryptographic operations. Furthermore, it relates to CWE-345 Insufficient Verification of Data Authenticity because the system accepts inputs that have been processed using a predictable and public key structure rather than verifying them against a secure secret context. In terms of MITRE ATT&CK framework classification, this behavior facilitates techniques associated with Credential Access such as T1110 Brute Force or T1110.003 Password Spraying when combined with stolen data dumps, although the primary flaw is in the cryptographic key management which falls under CWE-798 Use of Hard-coded Credentials if interpreted broadly as using a static public value for security-critical operations, though more accurately it represents CWE-327 Use of Broken or Risky Cryptographic Algorithm due to the misuse of HMAC with an insecure key source.
To mitigate this vulnerability and restore secure authentication practices, immediate remediation is required by updating WWBN AVideo to version 9c39d8c8 or later where the issue has been addressed. The fix involves replacing the public site URL as the HMAC key with a securely generated secret key that is stored in environment variables or configuration files inaccessible to end-users. Additionally, organizations should ensure that their deployment configurations do not expose sensitive internal paths or allow direct access to administrative endpoints like encryptPass.json.php from untrusted networks. Implementing rate limiting on authentication-related endpoints and enforcing strict input validation can provide defense-in-depth measures while the software is updated. Regular security audits focusing on cryptographic implementations are recommended to prevent similar flaws where public data is mistakenly used as a secret in hashing or signing operations.