Weak Password Generation and Insecure Hashing in AVideo

Executive Summary

CVE-2026-86187 affects WWBN AVideo versions up to 29.0 due to weak password generation for external-login accounts. The application uses the insecure rand() function, which produces only 31-bit integers, making passwords predictable. Attackers with access to password hashes can recover plaintext passwords quickly through offline brute-force attacks because passwords are stored using unsalted MD5 hashing.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your AVideo instance uses rand() for password generation in external-login flows. Inspect the codebase for rand() calls in login-related files. Look for unsalted MD5/SHA1/Whirlpool password hashes in the database. Verify if accounts created via social logins or plugins have predictable passwords.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to recover plaintext passwords from exposed hashes in minutes, enabling unauthorized access to accounts created via external logins. If users reuse passwords elsewhere, attackers could gain access to other accounts linked to the same email. The issue is exacerbated by the lack of salt in password hashing, making it easier to crack passwords across all installations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to inadequate security measures for protecting user credentials. GDPR requires appropriate technical measures to ensure data security, while HIPAA mandates safeguards for protected health information. The use of weak password generation and unsalted hashing undermines these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately replace rand() with a cryptographic generator like bin2hex(random_bytes(32)) in all password generation locations. Update the hashing mechanism to use salted hashes with a strong KDF (e.g., Argon2). Rotate all passwords generated via external logins. Monitor for unauthorized access attempts.

Useful 0 Not Useful 0