AVideo CVE-2026-86722

Exploitation requires: (1) a valid AVideo account username and password - the CVSS 4.0 PR:L metric confirms authenticated context is prerequisite; (2) email-based two-factor authentication must be enabled on the target account, since the vulnerability resides specifically in that code path; (3) the login attempt must originate from a device or browser not previously trusted by AVideo, in order to trigger new-device 2FA enrollment. The attack does NOT require network adjacency, administrative privileges, or any user interaction beyond the normal login flow. What limits exploitation is primarily credential availability: without the account password, the 2FA bypass is unreachable. The vulnerability does not provide a path to initial credential acquisition.

The CVSS 4.0 score of 8.6 with a PR:L vector accurately reflects the real-world constraint: this vulnerability requires possession of the target account's password before the 2FA bypass can be exercised. In practice this means the attack is not a standalone account takeover - it eliminates a defense-in-depth control (email 2FA) rather than creating an entry point from nothing. That said, the combination of credential compromise plus 2FA bypass is exactly the scenario 2FA is designed to prevent, so even a mid-sized municipal IT team in gniezno that has enabled 2FA on AVideo should treat this as urgent remediation rather than deprioritize it. EPSS data is not provided in the input, and the vulnerability is not in CISA KEV, suggesting limited or no observed exploitation to date. Attack complexity is genuinely low once credentials are in hand, and no special network position is required. The primary real-world limiting factor is credential availability, not technical sophistication. No public POC has been identified; risk is elevated for organizations that rely on 2FA as the primary post-breach control.

An attacker obtains AVideo account credentials through phishing, credential stuffing, or a prior breach. They then initiate a login from a device not previously recognized by the platform, which triggers the email 2FA flow. Because sqlDAL serves a stale empty cache result to the hash generation function, the 2FA check passes without the attacker receiving or entering any code, granting full account access.