CVE-2026-43875 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=<email>&pass=<HASH> where <HASH> is the victim's stored password hash (md5(hash("whirlpool", sha1(password)))) read directly from the users table. AVideo's own login endpoint (objects/login.json.php) accepts an encodedPass=1 flag that bypasses hashing and performs a direct string comparison between the supplied value and the stored hash. Anyone who captures the redirect URL — via server logs, referrer leakage, or browser history — therefore obtains a credential equivalent to the plaintext password and can fully take over the account, including admin accounts. Commit 977cd6930a97571a26da4239e25c8096dd4ecbc1 contains an updated fix.
A vulnerability in WWBN AVideo versions through 29.0 allows for password hash leakage during the OAuth login process in the MobileManager plugin. The issue arises in 'plugin/MobileManager/oauth2.php', which sends an HTTP 302 redirect containing the user's password hash, extracted from the database, to 'oauth2Success.php'. This hash can be intercepted through various means, such as server logs or browser history. AVideo's login endpoint can then be exploited to perform a direct comparison of the captured hash with the stored password hash, effectively bypassing the need for the actual plaintext password. This vulnerability enables full account takeover, including administrative accounts.
To address this vulnerability, remove the password hash from the OAuth redirect URL and implement server-side session management. Update 'plugin/MobileManager/oauth2.php' to log in the user without including credentials in the URL. Additionally, add a 'state' parameter and CSRF protection to prevent unauthorized OAuth redirects.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-5w8w-26ch-v5cw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/WWBN/AVideo/commit/977cd6930a97571a26da4239e25c8096dd4ecbc1 | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-5w8w-26ch-v5cw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |