CVE-2026-84483: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-84483 Overview

CVE-2026-84483 is an authentication bypass vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in encryptPass.json.php and allows unauthenticated attackers to compute valid HMAC-based authentication tokens using only publicly known values. Attackers derive tokens by calling hash_hmac with the site's base URL as the key and the current time, then submit arbitrary passwords to the endpoint to receive their encrypted hashes. This creates an oracle for offline precomputation attacks against stolen password databases. The vulnerability is categorized under [CWE-321: Use of Hard-coded Cryptographic Key].

Critical Impact

Unauthenticated remote attackers can convert AVideo into a password-hashing oracle, enabling offline attacks against stolen credential stores without any authenticated session.

Affected Products

• WWBN AVideo through commit 9c39d8c8
• encryptPass.json.php endpoint in AVideo
• Deployments exposing the AVideo web interface to the network

Discovery Timeline

• 2026-09-01 - CVE-2026-84483 published to the National Vulnerability Database (NVD)
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84483

Vulnerability Analysis

The vulnerability affects the encryptPass.json.php endpoint in WWBN AVideo. The endpoint uses an HMAC token to gate access, but the HMAC key is derived from the site's public base URL, a value any client can observe. The message input is the current time, which is also predictable. An unauthenticated attacker reconstructs the expected token locally by computing hash_hmac with those inputs.

Once armed with a valid token, the attacker submits arbitrary plaintext passwords and receives the corresponding encrypted hash from the server. This converts the endpoint into a hashing oracle. If an attacker later obtains a password database from another breach, they can precompute candidate hashes through the oracle and match them against stolen records offline.

Root Cause

The root cause is the use of a public, non-secret value as a cryptographic key. HMAC provides authenticity only when the key remains confidential. Because the site URL is broadcast in every HTTP response, the key material is effectively hard-coded and public, matching the [CWE-321] pattern. Combined with a predictable message (time()), any adversary can forge valid tokens.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker performs the following steps against a target AVideo instance:

1. Retrieve the target's public base URL.
2. Compute hash_hmac(algo, current_time, base_url) locally to produce a valid token.
3. Send a POST request to encryptPass.json.php with the forged token and a chosen password.
4. Read the returned encrypted hash and repeat for additional candidate passwords.

See the GitHub Security Advisory GHSA-q92q-q2f7-v4fc and the VulnCheck Advisory on AVideo for the technical writeup.

Detection Methods for CVE-2026-84483

Indicators of Compromise

• Unauthenticated POST requests to encryptPass.json.php from external sources
• High-frequency requests to the same endpoint from a single client, consistent with password enumeration
• Requests containing valid HMAC tokens paired with a wide variety of password parameter values
• Access patterns from residential proxies, VPN exit nodes, or Tor exit relays targeting the endpoint

Detection Strategies

• Alert on any request to encryptPass.json.php originating from an unauthenticated session or an untrusted network segment
• Baseline normal traffic to the endpoint and flag deviations in request volume, source diversity, or timing
• Correlate requests to encryptPass.json.php with the absence of a preceding authenticated login flow

Monitoring Recommendations

• Forward AVideo web server access logs into a centralized analytics platform for retention and query
• Monitor egress and ingress traffic to AVideo hosts for scanner signatures targeting the endpoint
• Track outbound traffic from AVideo servers that might indicate follow-on activity after credential validation

How to Mitigate CVE-2026-84483

Immediate Actions Required

• Restrict network access to encryptPass.json.php through web server ACLs, reverse proxy rules, or a web application firewall (WAF)
• Rate-limit requests to the endpoint at the reverse proxy layer to reduce oracle throughput
• Rotate any user passwords that may have been submitted through AVideo since the vulnerable code path was introduced
• Audit web server logs for prior requests to encryptPass.json.php and investigate anomalous sources

Patch Information

Upstream fix status should be tracked through the GitHub Security Advisory GHSA-q92q-q2f7-v4fc. Administrators should update AVideo to a commit that supersedes 9c39d8c8 and that replaces the public URL with a server-side secret for HMAC key material. Verify the patch removes both the public-key derivation and the predictable time-based message.

Workarounds

• Block external access to encryptPass.json.php at the WAF or reverse proxy until a patched version is deployed
• Require authenticated sessions before the endpoint can be invoked by enforcing session cookie validation at the proxy
• Replace the HMAC key with a locally generated server secret stored outside the web root if operating a fork of AVideo

# Example Nginx configuration to block external access to the vulnerable endpoint
location = /objects/encryptPass.json.php {
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
}