CVE-2026-86723: AVideo Authentication Bypass Vulnerability

CVE-2026-86723 Overview

CVE-2026-86723 is an authentication bypass vulnerability in AVideo, an open-source video streaming platform. The flaw resides in the LoginControl::verifyChallenge() method, which uses PHP loose comparison (==) instead of strict comparison (===) when validating session values. When the expected session value is unset, the loose comparison evaluates as true against an empty submission. Attackers holding only a valid password can submit an empty request to verifyChallenge.json.php to bypass PGP-based two-factor authentication and obtain full authenticated access. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is tracked under [CWE-287: Improper Authentication].

Critical Impact

Attackers with a valid password can bypass PGP two-factor authentication entirely by submitting an empty request, defeating the second authentication factor and gaining full account access.

Affected Products

• AVideo (WWBN/AVideo) platform through commit c3edcc274c389816d434acadac07ee78eaf330c1
• Installations with PGP two-factor authentication enabled via LoginControl
• The verifyChallenge.json.php endpoint in vulnerable builds

Discovery Timeline

• 2026-09-08 - CVE-2026-86723 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86723

Vulnerability Analysis

AVideo implements PGP-based two-factor authentication through the LoginControl class. After a user submits valid credentials, the server generates a challenge tied to a session variable. The client must return a signed response, which verifyChallenge() compares against the stored session value. The vulnerable implementation uses PHP loose equality (==) rather than strict equality (===). When the session variable is unset or empty and the attacker submits an empty payload to verifyChallenge.json.php, PHP's loose comparison treats both operands as equivalent. This causes the verification routine to return true, and the authentication state transitions to fully authenticated without any cryptographic verification.

Root Cause

The root cause is unsafe use of PHP's type-juggling equality operator against uninitialized session state. In PHP, null == "", null == 0, and null == false all return true. When the expected challenge value in $_SESSION is never populated for a given code path, comparing it against attacker-controlled input using == returns true for any falsy submission. Strict comparison (===) would enforce both value and type equality and reject the mismatch. This is a classic instance of [CWE-287] introduced by an insecure comparison pattern.

Attack Vector

The attack requires an authenticated first factor: the attacker must already possess a valid username and password. The attacker completes the primary login step and then sends an empty or crafted request to the verifyChallenge.json.php endpoint over the network. Because the challenge session value is never established or is unset in the exploited code path, the loose comparison succeeds and the session is marked as fully authenticated. No PGP key material, signed response, or knowledge of the challenge is required to complete the bypass. See the GitHub Security Advisory GHSA-vmpj-f3mf-q4j2 and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-86723

Indicators of Compromise

• POST or GET requests to verifyChallenge.json.php containing empty or missing challenge parameters followed by successful session establishment.
• Authenticated sessions belonging to PGP-2FA-enabled accounts that show no prior successful challenge validation event in application logs.
• Login sequences where the interval between primary password submission and full authentication lacks the expected PGP signing round trip.

Detection Strategies

• Review AVideo application logs for requests to verifyChallenge.json.php where the request body is empty or the challenge parameter is null.
• Correlate web server access logs with authentication state changes to identify sessions elevated to authenticated without a valid challenge response.
• Deploy web application firewall (WAF) rules that flag empty or malformed submissions to the verifyChallenge.json.php endpoint.

Monitoring Recommendations

• Enable verbose authentication logging in AVideo to capture challenge issuance, verification attempts, and outcomes for every 2FA-protected account.
• Alert on any successful authentication of a PGP-2FA account that is not preceded by a valid challenge issuance record within the same session.
• Monitor for repeated failed primary logins followed by a single successful session establishment against verifyChallenge.json.php.

How to Mitigate CVE-2026-86723

Immediate Actions Required

• Upgrade AVideo to a version published after commit c3edcc274c389816d434acadac07ee78eaf330c1 that replaces the loose comparison with strict equality.
• Audit all accounts with PGP two-factor authentication enabled for anomalous logins and force session revocation and password resets.
• Restrict network exposure of the AVideo administration and authentication endpoints while patching is in progress.

Patch Information

Refer to the upstream fix and vendor guidance in the GitHub Security Advisory GHSA-vmpj-f3mf-q4j2. The remediation replaces the loose comparison operator (==) in LoginControl::verifyChallenge() with strict comparison (===) and ensures the challenge session value is always initialized and validated as a non-empty string before comparison. Additional context is available in the VulnCheck Advisory.

Workarounds

• Temporarily block external access to verifyChallenge.json.php at the reverse proxy or WAF layer until patched builds are deployed.
• Disable the PGP two-factor authentication code path in LoginControl and enforce an alternative second factor if the codebase cannot be updated immediately.
• Enforce IP allowlisting on authentication endpoints so that only trusted networks can reach the vulnerable route.

# Example nginx snippet to restrict verifyChallenge.json.php access while patching
location = /plugin/PGP2FA/verifyChallenge.json.php {
    allow 10.0.0.0/8;
    deny all;
}