CVE-2026-86723

Deferred Deferred - Pending Action

Authentication Bypass in AVideo via Loose Comparison

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulnCheck

Description

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to verifyChallenge.json.php to bypass PGP two-factor authentication and gain full authenticated access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86723

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

AVideo has an authentication bypass flaw in LoginControl::verifyChallenge() due to using loose comparison (==) instead of strict comparison (===) when checking unset session values. Attackers can exploit this by sending an empty request to verifyChallenge.json.php with just a password, bypassing PGP two-factor authentication and gaining full access.

Detection Guidance

To detect this vulnerability, inspect AVideo's LoginControl::verifyChallenge() function for loose comparison (==) against unset session values. Check for requests to verifyChallenge.json.php with empty parameters. Monitor logs for successful logins without proper two-factor authentication verification.

Impact Analysis

If you use AVideo with PGP two-factor authentication, attackers could bypass login protections and gain unauthorized access to your account. This could lead to data theft, unauthorized actions, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately update AVideo to the latest version fixing the loose comparison issue. Replace == with === in LoginControl::verifyChallenge() for session value comparisons. Disable or restrict access to verifyChallenge.json.php until patched. Implement strict input validation for authentication endpoints.

Hi! I’m here to help you understand CVE-2026-86723. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70