AVideo CVE-2026-86723

The attacker must possess a valid AVideo account username and password - the vulnerability bypasses only the second factor, not the primary password check. Exploitation is additionally contingent on the target AVideo instance having PGP two-factor authentication enabled; installations without PGP 2FA configured are not affected by this specific code path (though they also lack the 2FA protection entirely). No other special configuration, platform, or network condition is required beyond network access to the AVideo login endpoints. The limiting factor is credential possession: an unauthenticated attacker with no prior knowledge of any account cannot exploit this vulnerability.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N) accurately characterizes this issue. The prerequisite of a valid password (PR:L) is the sole barrier; once credentials are obtained through phishing, credential stuffing, or prior breach, the 2FA bypass requires no additional skill - simply posting an empty body to a JSON endpoint. This is a significant devaluation of any 2FA-protected deployment's security posture: organizations that deployed PGP 2FA specifically to mitigate credential compromise risk have that control rendered ineffective. EPSS data is not available in the supplied input. No CISA KEV listing and no known public exploit code reduce immediate mass-exploitation probability, but the trivial nature of the bypass means any motivated attacker with valid credentials could execute it. The impact is confidentiality and integrity (VC:H/VI:H) with no availability impact, consistent with account takeover scenarios. Risk is elevated for any AVideo instance where PGP 2FA is the primary defense against credential-based unauthorized access.

An attacker obtains valid AVideo account credentials for a user whose account has PGP two-factor authentication enabled - via phishing, credential stuffing from a prior breach, or brute force. After submitting the correct username and password, the attacker sends an empty POST body to verifyChallenge.json.php; PHP's loose comparison in verifyChallenge() equates the empty submission to the unset session challenge value, returning true and issuing a fully authenticated session cookie without the attacker ever possessing the PGP key. No public exploit code is identified at time of analysis, but the bypass requires no tooling beyond a standard HTTP client.