Incorrect Authorization in WWBN AVideo Affects User Management and Upload
CVE-2026-126805

8.6HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126805?

AVideo versions up to 29.7.1 are susceptible to an incorrect authorization vulnerability that enables delegated Videos Admin users to acquire video_id_hash values associated with any video owner. This vulnerability leverages encoder endpoints, such as aVideoEncoderStatus.json.php, allowing attackers to obtain the hash for administrator-owned videos. Once in possession of the hash, they can exploit the useVideoHashOrLogin() function to bypass authentication, gaining unauthorized access to upload, configure, and manage users within the plugin.

Affected Version(s)

AVideo 0 <= 29.7.1

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-8...
vendor-advisory
https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8...
patch
https://github.com/WWBN/AVideo/blob/v29.7.1/objects/Encod...
technical-description

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.