Vulnerability Description
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx
- https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-authentication-byp
- https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx
FAQ
What is CVE-2026-92578?
CVE-2026-92578 is a vulnerability with a CVSS score of 8.1 (HIGH). WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest()...
How severe is CVE-2026-92578?
CVE-2026-92578 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92578?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.