Authentication Bypass Vulnerability in AVideo LoginControl by WWBN

CVE-2026-92914

What is CVE-2026-92914?

AVideo LoginControl is affected by an authentication bypass vulnerability related to the PGP second factor verification. This flaw allows attackers to circumvent the two-factor authentication by exploiting the way challenge responses are compared using loose equality against an uninitialized session variable. If an attacker possesses the victim’s password, they can send a parameter-less GET request to verifyChallenge.json.php, leading to a thwarted authentication process where null values are incorrectly evaluated. This oversight could potentially expose user accounts to unauthorized access.

References