CVE-2026-85154 Details
Description
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
A vulnerability in WWBN AVideo allows for authentication bypass through the use of a non-expiring, non-revocable bearer token known as video_id_hash. This token grants full administrative access to the video owner's account. Once obtained, the video_id_hash can be reused indefinitely to authenticate as the video owner, regardless of any password changes. The vulnerability is present in all versions of AVideo through 29.0.
To address this vulnerability, a patch has been developed that introduces an expiration and revocation mechanism for the video_id_hash. This patch binds the hash to the owner's current password, ensuring that it is invalidated when the password is changed. The patch also enforces a timeout for the hash, retiring any previously issued unbounded hashes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-expiring-video-id-hash | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 5, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |