CVE-2026-59808: AVideo Authentication Bypass Vulnerability

CVE-2026-59808 Overview

CVE-2026-59808 is an authentication bypass vulnerability in AVideo through commit 9c39d8c8. The flaw allows a low-privileged user with upload permission to obtain an administrator's video_id_hash and exchange it for a passwordless administrative session. The vulnerability chains two functions: deduplicateByEncoderQueueId(), which returns hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin(), which converts that hash into an authenticated session as the video owner. Successful exploitation grants full administrative access to the application and its configuration.

Critical Impact
Authenticated attackers with upload privileges can escalate to administrator by disclosing and replaying an admin video hash, then modifying system configuration.

Affected Products

AVideo platform through commit 9c39d8c8
Deployments exposing the encoder queue endpoints to authenticated uploaders
Instances that have not applied the upstream fix referenced in advisory GHSA-q32p-rw3q-8x3r

Discovery Timeline

2026-08-22 - CVE-2026-59808 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-59808

Vulnerability Analysis

The vulnerability [CWE-306: Missing Authentication for Critical Function] resides in AVideo's video deduplication and hash-based login logic. The deduplicateByEncoderQueueId() function accepts an encoder_queue_id and returns the associated video_id_hash without validating that the requester owns the referenced video. By omitting the videos_id parameter, an authenticated uploader can enumerate hashes belonging to other users, including administrators.

Once disclosed, the video_id_hash functions as a bearer credential. The useVideoHashOrLogin() routine accepts this hash in an unauthenticated request and establishes a session as the hash owner. This converts a video-level artifact into an identity primitive, effectively bypassing the login flow entirely.

With an administrative session, the attacker can modify system configuration, alter user accounts, and pivot to broader compromise of the hosting environment.

Root Cause

The root cause is missing authorization on a data-returning function combined with unauthenticated acceptance of a persistent secret. deduplicateByEncoderQueueId() treats encoder_queue_id as an unkeyed lookup, and useVideoHashOrLogin() trusts any caller presenting a valid hash. Neither function binds the hash to the requesting user's session or role.

Attack Vector

Exploitation requires an account with upload permission on the target AVideo instance. The attacker issues a crafted deduplication request omitting videos_id to leak an administrator's video_id_hash, then submits that hash to the hash-login endpoint over the network. No user interaction is required. The disclosed EPSS probability is 0.335% at the 26th percentile as of 2026-08-27.

The vulnerability manifests in the deduplication and hash-login functions described above. See the GitHub Security Advisory and the VulnCheck Authentication Bypass Advisory for the technical write-ups.

Detection Methods for CVE-2026-59808

Indicators of Compromise

Requests to encoder queue deduplication endpoints that omit the videos_id parameter while supplying encoder_queue_id.
Unauthenticated requests to the hash-login endpoint immediately followed by administrative actions from the same IP or session.
Session establishment for administrative accounts without a preceding password authentication event in application logs.
Configuration changes originating from accounts that historically only performed uploads.

Detection Strategies

Correlate uploader-role account activity with subsequent administrative session creation across web server and application logs.
Alert on any HTTP call to deduplicateByEncoderQueueId handlers where the videos_id parameter is absent.
Monitor useVideoHashOrLogin invocations and flag high-frequency or cross-user hash submissions.

Monitoring Recommendations

Enable verbose authentication logging in AVideo and forward events to a centralized log platform.
Baseline administrative login sources and alert on new IPs or user agents authenticating as admin.
Review audit trails for privilege changes, plugin installs, and system settings modifications following the vulnerable window.

How to Mitigate CVE-2026-59808

Immediate Actions Required

Upgrade AVideo to a commit later than 9c39d8c8 that includes the fix referenced in advisory GHSA-q32p-rw3q-8x3r.
Rotate administrator credentials and invalidate active sessions after patching.
Audit user roles and remove upload permissions from untrusted accounts until the patch is applied.
Review recent configuration changes and revert any unauthorized modifications.

Patch Information

Apply the upstream fix published in the AVideo GitHub Security Advisory GHSA-q32p-rw3q-8x3r. The patch enforces ownership checks in deduplicateByEncoderQueueId() and restricts useVideoHashOrLogin() so that a video_id_hash cannot be used as an unkeyed login credential.

Workarounds

Restrict network access to the AVideo application to trusted operators until the patch is deployed.
Disable self-service registration and revoke upload permissions from non-essential accounts.
Place a reverse proxy or web application firewall rule in front of the deduplication endpoint to block requests missing videos_id.

bash

# Example WAF rule (nginx) to block deduplication requests missing videos_id
location ~* /plugin/.*/deduplicate {
    if ($arg_videos_id = "") { return 403; }
    if ($arg_encoder_queue_id != "") { return 403; }
}