CVE-2026-33488 Details

A vulnerability in the LoginControl plugin of WWBN AVideo versions through 26.0 allows for bypassing PGP two-factor authentication (2FA). The issue arises because the 'createKeys()' function generates 512-bit RSA keys, which have been publicly factorable since 1999. An attacker who acquires a user's public key can easily factor the RSA modulus, derive the private key, and decrypt any PGP 2FA challenge, effectively nullifying the second authentication factor. Additionally, the 'generateKeys.json.php' and 'encryptMessage.json.php' endpoints lack authentication checks, exposing resource-intensive key generation to anonymous users.

Users should update to the patched version of the LoginControl plugin, which includes key generation with a minimum of 2048 bits and adds authentication to the previously unauthenticated endpoints. Instructions for updating the plugin can be found in the AVideo documentation.