CVE-2026-86187: WWBN AVideo Weak Password Generation Flaw

CVE-2026-86187 Overview

WWBN AVideo generates passwords for external-login accounts using the PHP rand() function instead of a cryptographically secure random number generator. The resulting passwords are constrained to 31-bit integer values, drastically shrinking the keyspace an attacker must search. AVideo compounds the problem by storing these passwords as unsalted MD5 hashes. An attacker who obtains a password hash can recover the plaintext credential in minutes through offline brute-force attacks. The weakness is categorized under CWE-330: Use of Insufficiently Random Values.

Critical Impact
Any leaked password hash from an external-login account can be reversed to a plaintext credential in minutes, enabling account takeover of AVideo users.

Affected Products

WWBN AVideo (external-login authentication component)
Deployments relying on rand()-generated passwords for federated accounts
Installations using unsalted MD5 password hashing

Discovery Timeline

2026-09-05 - CVE-2026-86187 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86187

Vulnerability Analysis

AVideo's external-login flow provisions accounts with server-generated passwords. The generation routine calls PHP's rand(), a non-cryptographic pseudo-random number generator that returns values up to RAND_MAX. On most platforms this ceiling is 2^31 - 1, limiting the output space to roughly 2.1 billion possibilities. That keyspace is trivially searchable on commodity hardware.

The stored representation of these passwords uses MD5 without a per-user salt. Unsalted MD5 permits precomputed lookups and GPU-accelerated brute-force at hash rates that exceed tens of billions per second on modern hardware. Combined with the 31-bit input space, complete recovery of any external-login password is a matter of minutes.

This vulnerability chains two distinct cryptographic failures: insecure random number generation and weak password hashing. Either issue alone would weaken authentication; together they eliminate any meaningful barrier between a leaked hash and a working credential.

Root Cause

The root cause is the use of rand() — a linear congruential generator not designed for security-sensitive contexts — to produce authentication secrets. PHP explicitly recommends random_bytes() or random_int() for cryptographic use. The absence of a salt in the MD5 hashing pipeline is the secondary defect that makes offline recovery practical.

Attack Vector

Exploitation requires an attacker to obtain the stored password hash for an external-login account. Typical acquisition paths include SQL injection, database backup exposure, insider access, or a separate server compromise. Once the hash is in hand, the attacker enumerates the 31-bit rand() output space, computes the MD5 for each candidate, and compares against the target hash. Successful recovery yields the account password, which can be replayed against the AVideo login endpoint or any service where the user reused the credential. Refer to the VulnCheck advisory and the GitHub Security Advisory GHSA-h3ff-c2qq-pr2g for additional technical context.

Detection Methods for CVE-2026-86187

Indicators of Compromise

Successful logins to external-login accounts from IP addresses not previously associated with the user.
Unexpected access to the AVideo users table or database backups containing password hashes.
Login sessions immediately followed by profile, email, or password changes on external-login accounts.

Detection Strategies

Audit the AVideo authentication codebase for calls to rand() or mt_rand() used in credential generation.
Inspect the users table for password hashes matching the MD5 of any integer in the range 0 to 2^31 - 1; matches confirm a vulnerable account.
Correlate web server access logs for enumeration patterns against the external-login endpoint.

Monitoring Recommendations

Alert on database read operations that return large volumes of rows from authentication tables.
Track authentication anomalies such as impossible travel and geolocation changes for external-login users.
Monitor for repeated failed logins followed by a successful login on the same account, indicating credential recovery attempts.

How to Mitigate CVE-2026-86187

Immediate Actions Required

Apply the vendor patch referenced in the GitHub Security Advisory GHSA-h3ff-c2qq-pr2g.
Force a password reset for every external-login account provisioned by the vulnerable code path.
Restrict database access and rotate any credentials that may have been exposed alongside the password hashes.

Patch Information

WWBN has published fix guidance through the AVideo security advisory. Administrators should upgrade to the patched release and verify that password generation uses random_bytes() or random_int() and that stored hashes use a modern algorithm such as bcrypt, argon2id, or PBKDF2 with per-user salts.

Workarounds

Disable the external-login feature until the patched version is deployed.
Replace generated passwords with administrator-issued credentials produced by a cryptographically secure generator.
Rehash existing passwords using password_hash() with PASSWORD_BCRYPT or PASSWORD_ARGON2ID and require users to reset their credentials on next login.

bash

# Configuration example
# Verify PHP uses secure primitives when regenerating credentials
php -r 'echo bin2hex(random_bytes(16)), PHP_EOL;'

# Identify AVideo source files still calling rand() in auth flows
grep -RIn --include="*.php" -E "\b(rand|mt_rand)\s*\(" /var/www/AVideo/plugin/ /var/www/AVideo/objects/