Vulnerability Description
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5
- https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-non-e
- https://github.com/WWBN/AVideo/security/advisories/GHSA-59p8-6m2v-gcr5
FAQ
What is CVE-2026-85154?
CVE-2026-85154 is a vulnerability with a CVSS score of 9.8 (CRITICAL). WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video...
How severe is CVE-2026-85154?
CVE-2026-85154 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-85154?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.