WWBN AVideo CVE-2026-85154

Exploitation requires the attacker to possess a valid video_id_hash for a target account; given that value, no authentication, user interaction, or special configuration is needed and it can be replayed remotely against a default AVideo deployment. The critical aggravating condition is that the hash never expires and is not revoked by a password change, so a leaked hash remains a working admin credential indefinitely. The main limiting factor is how easily an attacker can obtain a valid hash - if hashes are strong, secret, and never exposed in URLs/logs, practical exploitation is harder; if they are shared, logged, or guessable, the barrier is minimal.

This is a genuine high-priority issue rather than a paper-high CVSS: the vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes remote, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact, and that maps cleanly to a replayable admin credential. The single meaningful precondition - obtaining a valid video_id_hash - is not reflected as attack complexity in the vector; if these hashes are exposed in URLs, shares, logs, referrers, or predictable/enumerable forms, real-world complexity stays low, whereas if they are hard to obtain the practical bar rises. No EPSS score, KEV listing, or public POC was provided, so exploitation is not confirmed active; the severity rests on the vendor/VulnCheck advisories plus the design description. The password-change bypass is the aggravating factor - normal incident response (password reset) does not evict an attacker, so any operator running AVideo should treat this as urgent and prioritize the upgrade over relying on credential rotation.

An attacker harvests a video_id_hash - for example from a shared video link, browser history/referrer header, server log, or by enumeration - and replays it against the AVideo instance to obtain a fully privileged administrator session for the video owner. The attacker then manages content, users, and configuration as the owner; even after the victim discovers the compromise and changes their password, the stolen hash continues to grant access. No public POC was provided at time of analysis.