Weak Cryptographic Implementation in WWBN AVideo LoginControl Plugin

CVE-2026-33488

What is CVE-2026-33488?

The WWBN AVideo platform features a significant cryptographic vulnerability within the LoginControl plugin's implementation of the PGP 2FA system. Versions up to and including 26.0 utilize the createKeys() function to generate 512-bit RSA keys, a size deemed insecure since 1999 due to their susceptibility to factorization using standard computing resources. Any malicious actor with access to a user's public key can, therefore, compute the private key within hours, enabling them to bypass the second authentication factor entirely. Furthermore, critical endpoints such as generateKeys.json.php and encryptMessage.json.php lack necessary authentication checks, allowing unauthenticated users to trigger CPU-intensive key generation processes. Remediation has been addressed in commit 00d979d87f8182095c8150609153a43f834e351e.

References