CVE-2026-92578 in AVideo
Summary
by MITRE • 09/17/2026
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in WWBN AVideo versions up to 29.0 represents a critical authentication bypass flaw rooted in improper handling of cryptographic credentials within the application's core logic. This issue stems from a fundamental design error where the system fails to distinguish between raw stored password hashes and actual user-supplied passwords during the verification process. In secure systems, it is imperative that input data undergoes strict type checking or validation before being processed by authentication functions. However, in this instance, two distinct code paths within the application's backend logic are susceptible to exploitation: specifically the loginFromRequest function and the encryptPasswordVerify method. These components are responsible for validating user credentials against stored database records but lack sufficient safeguards to ensure that only properly hashed inputs derived from plaintext passwords are accepted as valid authentication attempts.
The technical mechanism of this vulnerability allows an attacker who has obtained a stored password hash, typically through data exfiltration or prior compromise, to bypass the login process entirely. By submitting the raw hexadecimal representation of the stored hash directly into the login endpoint fields intended for usernames and passwords, the application erroneously treats this input as a valid credential match. This occurs because the verification logic compares the submitted value against the stored hash without verifying that the submission originated from a legitimate password hashing routine or enforcing strict format constraints. Consequently, the system accepts the hash itself as proof of identity, effectively rendering traditional password-based authentication controls obsolete for any account whose credentials have been exposed in this manner.
From an operational impact perspective, this flaw poses severe risks to data integrity and confidentiality within the AVideo platform. Since attackers can authenticate as any user by leveraging stolen hashes, they gain unauthorized access to administrative privileges or sensitive personal information associated with those accounts. This capability facilitates lateral movement across the system, allowing malicious actors to manipulate video content, steal viewer data, or further compromise underlying infrastructure hosting the application. The severity is amplified in environments where multiple users share similar password patterns or when administrators are targeted specifically due to their elevated access levels. Such a bypass undermines trust in the platform's security posture and may lead to regulatory non-compliance depending on the nature of stored user data.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-521 regarding Weak Password Requirements if weak hashing algorithms were also employed alongside this logic flaw. In terms of offensive security frameworks, it corresponds to MITRE ATT&CK technique T1078, specifically the Valid Accounts subcategory, where adversaries leverage legitimate credentials obtained through various means to maintain persistent access without triggering typical intrusion detection alerts associated with brute-force or credential stuffing attacks. The ability to reuse stored hashes directly circumvents defenses designed to detect repeated failed login attempts since each successful authentication appears as a valid success event in logs.
Mitigation strategies must focus on immediate code remediation and enhanced monitoring practices. Developers should modify the encryptPasswordVerify and loginFromRequest functions to enforce strict input validation, ensuring that only properly formatted password inputs are processed through standard hashing algorithms before comparison with stored hashes. Implementing additional checks such as verifying salt usage or enforcing length constraints can further reduce attack surface area. Additionally, organizations running affected versions of AVideo should immediately upgrade to patched releases where this logic error has been corrected. For environments unable to patch instantly, implementing web application firewall rules that detect and block requests containing hexadecimal strings in password fields may provide temporary relief while limiting exposure until permanent fixes are deployed. Regular audits of authentication flows and penetration testing focused on credential handling mechanisms will help identify similar architectural weaknesses before they can be exploited by adversaries seeking unauthorized access.