AVideo CVE-2026-59808

Exploitation requires the attacker to hold an active account with upload permission on the target AVideo instance (CVSS PR:L). The instance must be reachable over the network (AV:N). The vulnerable code path is present in the default AVideo codebase through commit 9c39d8c8 - no non-default configuration is required beyond the upload-permission prerequisite. The key limiting factor is the upload account requirement: AVideo deployments that restrict self-registration or grant upload rights only to fully trusted internal users significantly reduce their effective attack surface. No victim interaction is required (UI:N), and no race condition or special timing is involved (AT:N). Exploitation impact is limited to the AVideo application scope - there is no evidence of direct host-level exploitation from the available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, accurately reflecting network reachability, low attack complexity, and high CIA impact across the vulnerable system; the primary limiting factor is PR:L - an upload-permission account on the target instance is a prerequisite. No EPSS data was included in the available intelligence, the vulnerability carries no CISA KEV listing, and no confirmed public proof-of-concept exploit is known, leaving real-world exploitation rate unconfirmed. The attack is mechanically straightforward once the prerequisite account is obtained, and any deployment that permits self-registration or broadly grants upload rights is functionally exposed to full administrative compromise with no additional complexity. The absence of subsequent-system scope change (SC:N/SI:N/SA:N) confines the blast radius to the AVideo application itself, a meaningful constraint on downstream host-level risk. No conflicting signals between the CVSS vector and the description were identified - the PR:L rating correctly reflects the upload-account prerequisite described in the advisory.

An attacker with a standard upload account calls deduplicateByEncoderQueueId() while omitting the videos_id parameter, causing the function to return the video_id_hash associated with an administrator's video. The attacker then submits this hash to useVideoHashOrLogin() in a separate unauthenticated request, which establishes a full administrative session without requiring a password. With administrative access, the attacker can alter system configuration, create persistent backdoor accounts, or access all hosted media and user data. No public proof-of-concept has been confirmed at the time of analysis.