Authentication Bypass in WWBN AVideo by Exploiting Stored Password Hash

CVE-2026-92578

What is CVE-2026-92578?

The AVideo application by WWBN, up to version 29.0, contains a significant vulnerability that allows an attacker to bypass authentication measures. This issue arises due to the application's acceptance of stored password hashes as valid credentials. If an attacker gains access to the stored password hash of a user, they can exploit this flaw by submitting the hash directly to the login endpoints, effectively authenticating themselves as any user without needing the actual password. This represents a critical security risk, as it undermines the integrity of user authentication mechanisms.

References