WWBN AVideo CVE-2026-86187

Exploitation requires prior access to the AVideo password hash database - whether through a separate vulnerability (SQL injection, exposed database backup, misconfigured cloud storage) or privileged administrative access to the database server. Only accounts provisioned through the external-login pathway are affected; standard accounts may not use rand()-based password generation. The offline brute-force phase requires no interaction with the AVideo application itself and can be performed on commodity hardware. Limiting factors: (1) the attacker must independently obtain hash access before this vulnerability is useful; (2) only external-login accounts are in scope; (3) recovering a password yields access only to that specific AVideo account, not broader system access unless credentials are reused.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N) accurately captures the significant prerequisites: high attack complexity and high privilege requirements reflect that the attacker must first obtain the password hash database before the weak PRNG becomes exploitable. This two-stage requirement substantially limits opportunistic exploitation. However, if a secondary vulnerability such as SQL injection, misconfigured database backup, or insider access provides hash exposure, the weak PRNG converts that lower-severity breach into a full credential compromise across all external-login accounts. No EPSS score or CISA KEV status is available in the provided data, so exploitation probability cannot be quantified numerically. No public exploit specific to this CVE has been identified at time of analysis. The real-world risk is moderate: high-impact once hash access is achieved, but not directly exploitable over the network without a prerequisite breach.

An attacker who has obtained an AVideo database dump - through SQL injection, an exposed backup file, or a compromised database host - extracts the MD5 hashes of external-login accounts. Using a GPU-based MD5 cracker (e.g., hashcat), the attacker iterates over all 2^31 possible rand() output values, computing the corresponding MD5 for each, and recovers matching plaintext passwords in under a minute. The attacker then authenticates to the AVideo web interface as the victim user, gaining full account access. No public PoC tool specific to this CVE has been identified.