CVE-2026-92578: WWBN AVideo Authentication Bypass Vulnerability

CVE-2026-92578 Overview

WWBN AVideo through version 29.0 contains an authentication bypass vulnerability that accepts the stored password hash as a valid login credential. The flaw affects two independent code paths: loginFromRequest() and encryptPasswordVerify(). An attacker who obtains the users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification. This vulnerability is tracked as [CWE-287: Improper Authentication].

Critical Impact

Any exposure of the stored password hash, through SQL injection, backup leaks, or database compromise, becomes a direct account takeover across all users, including administrators.

Affected Products

• WWBN AVideo through version 29.0
• AVideo streaming platform installations exposing login endpoints
• Deployments where the users table hash column may be reachable via any secondary flaw

Discovery Timeline

• 2026-09-16 - CVE CVE-2026-92578 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92578

Vulnerability Analysis

AVideo stores user credentials in the users.password column using a hashing routine. During login, the application should hash the submitted password and compare the result to the stored value. Instead, the verification logic treats the stored hash itself as an acceptable input. Submitting the raw hash to the login flow satisfies the comparison and grants a valid session for the target account.

The defect exists in two independent paths, loginFromRequest() and encryptPasswordVerify(), which broadens the exposed attack surface. Any endpoint reaching either function inherits the bypass. Because authentication succeeds without knowledge of the plaintext password, attackers who obtain hashes through database backups, log exposure, secondary SQL injection, or misconfigured storage escalate directly to full account takeover, including administrative accounts that can pivot to remote code execution through AVideo's plugin and encoder features.

Root Cause

The root cause is broken authentication logic in the password verification routines. The verifier does not enforce a one-way transformation on the submitted credential before comparison. When the stored hash is passed in place of the plaintext password, the comparison returns true. This design collapses the distinction between a secret and its verifier, converting the hash into a password-equivalent credential.

Attack Vector

Exploitation requires network access to the AVideo login endpoint and possession of a target user's stored password hash. No user interaction and no prior authentication are required. The attacker submits the hash value in the password field of a standard login request. The server accepts it and returns an authenticated session. Refer to the VulnCheck Authentication Bypass Advisory and the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-92578

Indicators of Compromise

• Successful logins from unusual IP addresses or geolocations for administrator accounts on AVideo installations running 29.0 or earlier.
• Authentication requests where the submitted password value length and character set match the format of a bcrypt or MD5 hash rather than a plaintext password.
• New administrative sessions immediately followed by plugin installation, encoder configuration changes, or file uploads.
• Repeated login attempts against many usernames from the same source shortly after a database exposure event.

Detection Strategies

• Inspect login request bodies at the web application firewall or reverse proxy for password parameters that resemble hash strings, such as values matching ^\$2[aby]\$ for bcrypt or 32 or 64 hex characters for MD5 or SHA-256.
• Correlate authentication success events with source reputation and prior failed attempts to identify credential-stuffing behavior using leaked hashes.
• Audit AVideo application logs for successful loginFromRequest() invocations that lack a preceding password-reset or account-creation event tied to the source.

Monitoring Recommendations

• Alert on any change to the users table, particularly reads by non-application database accounts.
• Monitor for outbound connections from the AVideo host to unknown endpoints following administrative logins, which may indicate post-exploitation activity.
• Track privileged actions such as plugin uploads, encoder job creation, and configuration edits and require secondary approval where feasible.

How to Mitigate CVE-2026-92578

Immediate Actions Required

• Upgrade AVideo to a version later than 29.0 once the vendor publishes a fixed release. Consult the GitHub Security Advisory for current guidance.
• Rotate all user passwords after upgrading so that any previously exposed hashes are invalidated as authentication material.
• Invalidate all existing sessions and API tokens to evict attackers who may have authenticated using stolen hashes.
• Audit the users table access history and restrict database credentials used by the application to the minimum required privileges.

Patch Information

Refer to the GitHub Security Advisory GHSA-fq38-jp6c-q4cx for the vendor's remediation guidance. The fix must ensure that loginFromRequest() and encryptPasswordVerify() hash the submitted credential and compare it to the stored value, rejecting any input that equals the stored hash directly.

Workarounds

• Restrict access to the AVideo administrative and login endpoints using IP allowlisting at the reverse proxy until the upgrade is applied.
• Deploy a web application firewall rule that rejects login requests whose password parameter matches known hash formats such as bcrypt prefixes or hexadecimal strings of length 32, 40, or 64.
• Enforce multi-factor authentication in front of AVideo through an identity-aware proxy where the upstream application cannot be modified.
• Remove or secure any database backups, exports, or log files that contain the users.password column.