CVE-2026-86187 Details

A vulnerability exists in WWBN AVideo in all versions through 29.0, where passwords for accounts created through external-login flows are generated using the rand() function, rather than a cryptographic random number generator. This method produces passwords that are only 31 bits of entropy, consisting solely of decimal digits. The vulnerability is exacerbated by the use of unsalted MD5 hashing for password storage, allowing attackers with access to the hashed passwords to recover the original plaintext passwords within minutes using offline brute-force techniques.

To address this vulnerability, update the password generation method to use a cryptographic random number generator. AVideo has the capability to do this, as demonstrated in its password generation for admin accounts. Additionally, consider migrating the password hashing method to a more secure algorithm that includes a work factor, such as bcrypt or Argon2.