CVE-2026-86722: AVideo Authentication Bypass Vulnerability

CVE-2026-86722 Overview

CVE-2026-86722 is an authentication bypass vulnerability in AVideo, an open-source video streaming platform. The flaw exists in the sqlDAL data access layer, which caches empty result sets that the writeSql function never invalidates. Attackers holding a valid password can bypass email-based two-factor authentication (2FA) when logging in from a new device. The confirmation code hash fails to generate because the lookup returns a stale cached empty result, allowing the login flow to proceed without validating the 2FA code. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Attackers with stolen or compromised credentials can bypass email 2FA on new devices, defeating a key account-takeover control and gaining full access to user accounts.

Affected Products

AVideo (WWBN/AVideo) through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments using the built-in email two-factor authentication feature
Any AVideo installation relying on sqlDAL cache behavior for authentication flows

Discovery Timeline

2026-09-08 - CVE-2026-86722 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86722

Vulnerability Analysis

The vulnerability is classified as an Authentication Bypass under [CWE-287]. AVideo's sqlDAL component implements a query cache to reduce database load. When a query returns an empty result set, the cache stores that empty result. Subsequent write operations performed through writeSql do not invalidate related cache entries, so reads continue to return the stale empty set even after new rows exist in the underlying tables.

During the email two-factor authentication flow, AVideo generates a confirmation code, hashes it, and writes the hash to the database. The verification step then reads the hash back to compare it against the code submitted by the user. Because the read is served from the cached empty result, the hash comparison fails to load any value. The flow treats the missing hash as satisfied and permits the login to complete without validating the emailed code.

Root Cause

The root cause is a missing cache invalidation contract between sqlDAL and writeSql. Write operations do not signal the cache layer to purge or refresh affected keys. Empty result sets are treated as valid cacheable values rather than as sentinel misses that should be revalidated after writes.

Attack Vector

Exploitation requires an attacker to possess valid credentials for a target account, obtained through phishing, credential reuse, or prior breach. The attacker initiates a login from a new device, which normally triggers the email 2FA challenge. Because the 2FA confirmation record is not readable through the cache, AVideo accepts the login without a valid code. The attacker gains authenticated access to the account without ever accessing the target's email inbox. The attack requires network access to the application and low privileges (a valid password).

Refer to the GitHub Security Advisory GHSA-wmhg-p72j-72gf and the VulnCheck Advisory: AVideo SQL Bypass for additional technical detail.

Detection Methods for CVE-2026-86722

Indicators of Compromise

Successful logins from new devices or unfamiliar IP addresses without a corresponding 2FA email confirmation event in application logs.
Authentication events where the 2FA confirmation code record is absent yet the session was marked as verified.
Sudden surges in successful logins following a credential-stuffing or password-spray campaign targeting an AVideo instance.

Detection Strategies

Correlate application authentication logs with mail server logs to identify sessions marked as 2FA-verified without a matching outbound confirmation email.
Alert on logins from user-agent, device fingerprint, or ASN values that do not match historical baselines for each account.
Review database write logs for users_2fa or equivalent confirmation-code tables and compare timestamps against successful login events.

Monitoring Recommendations

Enable verbose authentication logging in AVideo and forward logs to a centralized SIEM for behavioral analysis.
Monitor for repeated authentication attempts across many accounts originating from the same source, indicating credential reuse.
Track administrative account logins closely and require out-of-band verification for privileged account activity.

How to Mitigate CVE-2026-86722

Immediate Actions Required

Update AVideo to a build that includes the fix released after commit c3edcc274c389816d434acadac07ee78eaf330c1. Consult the GitHub Security Advisory for the fixed reference.
Force password resets for all accounts, particularly administrators, on the assumption that credentials may already be compromised.
Invalidate active sessions and require re-authentication after applying the patch.
Audit recent login events for signs of unauthorized access predating the fix.

Patch Information

The upstream project has published a security advisory at GHSA-wmhg-p72j-72gf. Administrators should pull the latest AVideo commit from the WWBN/AVideo repository, redeploy, and verify that the sqlDAL cache is invalidated on writes affecting the authentication and 2FA tables.

Workarounds

Disable the sqlDAL query cache in configuration until the patched build can be deployed, accepting the associated performance overhead.
Restrict administrative and user login endpoints to trusted IP ranges using a reverse proxy or web application firewall (WAF).
Enforce strong, unique passwords and monitor for credential-stuffing patterns to reduce the pool of usable credentials for this bypass.

bash

# Configuration example: restrict login endpoint at the reverse proxy
# nginx example limiting /user access to a trusted management network
location /user {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://avideo_backend;
}