CVE-2026-92913: AVideo Auth Bypass Vulnerability

CVE-2026-92913 Overview

CVE-2026-92913 is an insecure random number generation flaw [CWE-330] in AVideo, an open-source video streaming platform. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The getRandomCode() function in objects/functions.php derives login pairing codes from uniqid() output combined with a single rand() character used only as padding. This reduces the effective code space to roughly 2^25 values for a known generation second. An unauthenticated attacker who guesses a valid code can obtain the target account's email and a one-year authentication hash, resulting in full account takeover.

Critical Impact

Unauthenticated remote attackers can brute-force login pairing codes to hijack any AVideo account and obtain a credential valid for one year. No patched version is currently available.

Affected Products

• AVideo platform through commit c3edcc274c389816d434acadac07ee78eaf330c1
• Deployments exposing plugin/API/set.json.php and plugin/API/get.json.php endpoints
• All installations using the login_code pairing feature

Discovery Timeline

• 2026-09-17 - CVE-2026-92913 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92913

Vulnerability Analysis

The flaw resides in the getRandomCode() function within objects/functions.php. The function generates login pairing codes using sprintf('%08x%05x', seconds, microseconds) derived from uniqid(), appending only a single character from rand() as padding. Because the timestamp portion is deterministic when the generation second is known, the effective randomness collapses to approximately 36 x 10^6 values (~2^25).

The endpoint plugin/API/set.json.php?APIName=login_code accepts unauthenticated requests and returns response timing that reveals the server's exact microtime. This turns the endpoint into an oracle for narrowing the search space further. Once a valid unexpired code is guessed, redemption at plugin/API/get.json.php?APIName=login_code returns the target account's email and a User::getUserHash(users_id, '+1 year') value accepted in place of the password for one year.

Root Cause

The root cause is the use of a cryptographically weak pseudo-random number generator for security-sensitive tokens. uniqid() in PHP is documented as not cryptographically secure, and rand() similarly lacks entropy suitable for authentication material. A single rand() character cannot compensate for the predictability of microsecond-precision timestamps.

Attack Vector

An unauthenticated remote attacker calls plugin/API/set.json.php?APIName=login_code to trigger code generation and infer the server microtime. The attacker then enumerates candidate codes within the reduced 2^25 keyspace before the 10-minute expiration window closes. Upon a successful guess at plugin/API/get.json.php?APIName=login_code, the response discloses the account email and a one-year authentication hash usable in place of the password.

No verified exploit code is published. See the GitHub Security Advisory
and VulnCheck advisory for technical details on the PRNG weakness and
endpoint interactions described above.

Detection Methods for CVE-2026-92913

Indicators of Compromise

• High-volume requests to plugin/API/get.json.php?APIName=login_code from single or distributed source addresses
• Repeated calls to plugin/API/set.json.php?APIName=login_code from unauthenticated clients
• Successful login events using getUserHash credentials without a preceding password authentication
• Account activity originating from IP addresses that recently issued login_code API traffic

Detection Strategies

• Rate-limit and log all requests to plugin/API/set.json.php and plugin/API/get.json.php endpoints
• Alert on burst enumeration patterns against the login_code API within short time windows
• Correlate authentication events using hash-based credentials against the source IPs of preceding login_code API activity

Monitoring Recommendations

• Ingest AVideo web server access logs into a centralized logging platform for retention and query
• Baseline normal call volumes to the login_code endpoints and alert on statistical deviations
• Monitor for account email disclosures returned from get.json.php responses to unauthenticated sessions

How to Mitigate CVE-2026-92913

Immediate Actions Required

• Restrict network access to the plugin/API/set.json.php and plugin/API/get.json.php endpoints using firewall or reverse proxy rules
• Disable the login_code pairing feature if it is not required for production use
• Invalidate any long-lived user hash tokens issued prior to remediation and force password resets on affected accounts
• Deploy a web application firewall rule to block unauthenticated brute-force patterns against the login_code API

Patch Information

No patched version is available at the time of publication. Monitor the GitHub Security Advisory and the VulnCheck Advisory for upstream fix availability.

Workarounds

• Place AVideo behind an authenticated reverse proxy that blocks unauthenticated access to the login_code endpoints
• Enforce strict rate limiting on the login_code endpoints to make brute-force enumeration within the 10-minute expiry window impractical
• Shorten the pairing code expiration window through custom code changes if operationally feasible

# Example nginx rate limit and access restriction for login_code endpoints
limit_req_zone $binary_remote_addr zone=logincode:10m rate=5r/m;

location ~ ^/plugin/API/(set|get)\.json\.php$ {
    if ($arg_APIName = "login_code") {
        limit_req zone=logincode burst=5 nodelay;
        # allow 10.0.0.0/8; deny all;  # optional IP allowlist
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}