Weak Password Generation in WWBN AVideo External Login Implementation

CVE-2026-86187

What is CVE-2026-86187?

WWBN AVideo has a significant vulnerability where it generates passwords for external login accounts using the 'rand()' function rather than a secure cryptographic generator. This method results in only 31-bit integers being produced, leading to weak password security. Additionally, the use of unsalted MD5 hashing for password storage allows attackers with access to password hashes to execute efficient offline brute-force attacks, potentially recovering plaintext passwords in just a few minutes. This presents a critical risk for users relying on the platform for secure logins.

References