Authentication Bypass in AVideo by WWBN Due to Non-Expiring Bearer Token

CVE-2026-85154

What is CVE-2026-85154?

AVideo by WWBN is impacted by a vulnerability that allows attackers to exploit a non-expiring, non-revocable bearer token known as video_id_hash. This token grants full administrative access to the video owner's account, enabling unauthorized users to authenticate as the owner indefinitely. Even changing account passwords does not invalidate the video_id_hash, leading to a significant security risk. Users of AVideo should be aware of this issue to mitigate potential attacks.

References