CVE-2026-92914 Details

An authentication bypass vulnerability has been identified in the AVideo LoginControl component, specifically in the PGP second factor verification process. This vulnerability arises because challenge responses are compared using loose equality against an uninitialized session variable. As a result, attackers who have access to a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php. The request evaluates null == null, leading to the incorrect conclusion that authentication is complete.

It is recommended to change the verification process to use strict equality comparisons and to implement additional checks, such as ensuring the challenge is single-use and has an expiry. Also, the challenge should be required before allowing users to replace their PGP keys.