CVE-2026-85154
Received Received - Intake

Authentication Bypass in WWBN AVideo via Video ID Hash

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85154
EUVD
EUVD-2026-70389

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WWBN AVideo has an authentication failure where the video_id_hash acts as a permanent bearer token granting full admin access to the video owner's account. Attackers can reuse this token indefinitely to impersonate the owner with full privileges, even if the owner changes their password.

Impact Analysis

If you are an AVideo user, attackers could gain full administrator access to your account by obtaining your video_id_hash. This could lead to unauthorized video uploads, deletions, or modifications, and compromise all your account data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using AVideo may face compliance violations and legal penalties.

Mitigation Strategies

Immediately invalidate all existing video_id_hash credentials by updating the application to generate new, expiring tokens. Review all active sessions and force password resets for affected accounts. Monitor for unauthorized access attempts using these credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart