EUVD-2026-69721
GHSA-5vfg-9qx8-h8wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid credentials out-of-band
-
DeliveryCraft login request with User-Agent: AVideoEncoder
-
ExploitServer treats client as trusted
-
ExecutionBypass 2FA, captcha, and audit logging
-
ImpactStealthy authenticated account access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires possession of valid account credentials - this is a bypass of the second factor and anti-abuse controls, not a credential-less login. Given valid credentials, the only additional requirement is setting the request's User-Agent header to the exact literal 'AVideoEncoder' or 'AVideoMobileApp'; no IP allow-list, shared secret, or token is checked. Limiting factors: the target account must have 2FA/captcha/audit as its protective controls (otherwise nothing meaningful is bypassed), and the attacker must first obtain the password out-of-band. No user interaction and no special server configuration beyond a default AVideo install at commit e01e41ecc or earlier. |
| Impact | The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) rates this 9.3 (Critical), but the PR:N (no privileges) is questionable: the description explicitly states the attacker 'submits valid credentials,' meaning this is a second-factor/anti-abuse bypass that presupposes knowledge of a valid password - functionally PR:L, not PR:N. That materially lowers real-world risk versus a pure pre-auth bypass: the attacker must already have credentials (phished, reused, or credential-stuffed), after which 2FA - the control meant to stop exactly that - is nullified. Attack complexity is genuinely low (one header) and remotely exploitable. No EPSS, KEV, or POC is provided; treat as 'no public exploit identified at time of analysis' rather than actively exploited. Net: a real and high-value hardening bypass for accounts whose passwords are already at risk, but not an unauthenticated full-compromise; prioritize for any AVideo instance relying on 2FA/captcha for account security. |
| Exploit ScenarioDerived | An attacker who has obtained one valid username/password (via phishing or credential stuffing) sends the login request with the header 'User-Agent: AVideoEncoder'. The server treats the request as coming from a trusted encoder, so it skips the victim's 2FA prompt, ignores captcha escalation despite prior failed attempts, and records no entry in the login/device audit history - yielding a stealthy account takeover. No POC is published, but the header trick requires only a single line in any HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
RemediationAI
No vendor-released patch identified at time of analysis. Since AVideo authenticates trusted clients by User-Agent alone, the actionable compensating controls are: at the reverse proxy / WAF, strip or normalize inbound User-Agent so external clients cannot present 'AVideoEncoder'/'AVideoMobileApp' (side effect: legitimate encoder/mobile-app logins from outside a trusted network will lose their exemptions and may face 2FA/captcha, which is arguably the desired behavior); restrict the encoder/app endpoints to known source IPs via allow-list (side effect: breaks roaming mobile clients); and enforce 2FA server-side independent of client type until a fix lands. Monitor the GitHub advisory GHSA-m9m3-gwh2-337c for a patched commit/release and upgrade as soon as one is published; the fix should bind trusted-client status to a shared secret or source-IP check rather than the User-Agent header.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo is an open-source PHP video-streaming/CMS platform (cpe:2.3:a:wwbn:avideo). It ships companion clients - the AVideoEncoder and the AVideoMobileApp - and grants them relaxed login handling under the assumption that only those trusted clients would identify themselves as such. The root cause is CWE-290 (Authentication Bypass by Spoofing): the server distinguishes 'trusted client' vs. 'browser' purely by string-matching HTTP_USER_AGENT against hardcoded literals ('AVideoEncoder'/'AVideoMobileApp'). Because the User-Agent is fully attacker-controlled and no second authentication factor (source IP, mutual TLS, HMAC/shared secret) binds the claim, any HTTP client can impersonate the trusted encoder/app and inherit its exemptions from 2FA, captcha, and audit recording.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Exploitation presupposes valid credentials (a 2FA/anti-abuse bypass), so PR:L not PR:N; single spoofed header gives low complexity, no UI, and high confidentiality/integrity impact to the account with no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
Technical POC Analysis
Primary bug class is CWE-290 Authentication Bypass by Spoofing: the login flow trusts a client-controlled User-Agent header as if it were an immutable indicator of a trusted first-party client.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
WWBN AVideo (commit e01e41ecc and earlier) contains a critical vulnerability allowing any authenticated user to disable two-factor authentication, bypass CAPTCHA controls, and delete audit logs through HTTP header manipulation. Organizations deploying AVideo face substantial risk of account compromise and undetected malicious activity from within their authenticated user base.
Implement Web Application Firewall rules to block or flag suspicious User-Agent values matching 'AVideoEncoder' or 'AVideoMobileApp' from untrusted networks; require mutual TLS (mTLS) certificates for all encoder and mobile client connections; maintain strict IP allow-lists for mobile/encoder endpoints; disable mobile and encoder APIs entirely if not required; enable verbose 2FA and login audit logging with automated alerts for 2FA bypass or deletion attempts; review login audit logs weekly for anomalous device access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB